From 6aac54a915130f9aee23d27cdabcdfa0c5df42d8 Mon Sep 17 00:00:00 2001 From: George Stykalin Date: Sun, 28 Apr 2024 00:25:30 +0300 Subject: [PATCH] move cert-manager and ingress-nginx from kubespray to separate modules, remove reset action and update observability template --- cmd/main/main.go | 22 +- config.yaml | 57 +- kubespray/inventory/group_vars/all.yml | 5 + .../group_vars/k8s_cluster/addons.yml | 2270 ++++++++++++++++- kubespray/project/cluster.yml | 6 +- pkg/config/modules_additional.go | 28 +- pkg/config/modules_observability.go | 13 +- pkg/config/orchestrator.go | 2 +- pkg/kubespray/cluster.go | 4 +- pkg/kubespray/utility.go | 2 +- .../additional-modules/cert-manager.yml.tmpl | 1267 +++++++++ .../additional-modules/ingress-nginx.yml.tmpl | 908 +++++++ .../additional-modules/longhorn.yml.tmpl | 7 +- .../observability/observability.yml.tmpl | 79 +- .../inventory/group_vars/all.yml.tmpl | 5 + .../group_vars/k8s_cluster/addons.yml.tmpl | 19 +- .../k8s_cluster/k8s-cluster.yml.tmpl | 2 +- pkg/templates/templates.go | 2 + 18 files changed, 4606 insertions(+), 92 deletions(-) diff --git a/cmd/main/main.go b/cmd/main/main.go index fad25a0..4b2184b 100644 --- a/cmd/main/main.go +++ b/cmd/main/main.go @@ -8,21 +8,17 @@ import ( "os" ) -func parseArgs() (string, string, string, string) { - var password string - var configPath string - var dataDir string - var tags string +func parseArgs() (string, string, string) { + var password, configPath, dataDir string flag.StringVar(&password, "p", "", "Password to access hosts") flag.StringVar(&configPath, "c", "/etc/kube-forge/config.yaml", "Path to config file") flag.StringVar(&dataDir, "d", "/var/lib/kube-forge", "Path to data dir") - flag.StringVar(&tags, "t", "", "List of tags to apply (ex: ingress,dns)") flag.Parse() - return password, configPath, dataDir, tags + return password, configPath, dataDir } func main() { - password, configPath, dataDir, tags := parseArgs() + password, configPath, dataDir := parseArgs() config := config.CreateConfig(configPath, dataDir, password) repositories, releases := templates.GetHelmAppsConfigData() @@ -34,12 +30,14 @@ func main() { for _, cmd := range os.Args { switch cmd { case "apply": - kubespray.InstallCluster(tags) + kubespray.InstallCluster("") kubespray.CopyK8SAdminConfig("k8s-admin.conf") - case "reset": - kubespray.ResetCluster() + case "apply-modules": + kubespray.InstallCluster("helm-apps") case "upgrade": - kubespray.UpgradeCluster(tags) + kubespray.UpgradeCluster("") + case "scale": + kubespray.ScaleCluster() } } } diff --git a/config.yaml b/config.yaml index 2946df7..8a6e82a 100644 --- a/config.yaml +++ b/config.yaml @@ -96,32 +96,34 @@ modules: retention: 7d alert_manager: - enabled: false + enabled: true + # additionalMessageTemplates: {} - # route: - # receiver: kvazaric_notifications - # group_wait: 1s - # repeat_interval: 180m + route: + receiver: kvazaric_notifications + group_wait: 1s + repeat_interval: 180m + + routes: + - receiver: "kvazaric_notifications" + group_by: ["alertname"] + group_wait: 1s + repeat_interval: 8737h + matchers: + - fireOnce=true + receivers: + - name: kvazaric_notifications + telegram_configs: + - send_resolved: true + api_url: https://api.telegram.org + bot_token: 6364937365:AAHcJKc-McN11gBWuQqoM87zr18eK0VKX9I + chat_id: -968770779 + parse_mode: HTML + message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw %}' + http_config: + follow_redirects: true + enable_http2: false - # routes: - # - receiver: "kvazaric_notifications" - # group_by: ["alertname"] - # group_wait: 1s - # repeat_interval: 8737h - # matchers: - # - fireOnce=true - # receivers: - # - name: kvazaric_notifications - # telegram_configs: - # - send_resolved: true - # api_url: https://api.telegram.org - # bot_token: 6364937365:AAHcJKc-McN11gBWuQqoM87zr18eK0VKX9I - # chat_id: -968770779 - # parse_mode: HTML - # message: '{{ template "telegram-message" . }}' - # http_config: - # follow_redirects: true - # enable_http2: false blackbox: enabled: true additional_modules: | @@ -245,7 +247,8 @@ modules: additional: cert_manager: - install: true + enabled: true + ha_enabled: false dns_servers: - "1.1.1.1" - "8.8.8.8" @@ -253,9 +256,7 @@ modules: ingress: type: nginx # nginx - install: true - insecure_port: 80 - secure_port: 443 + enabled: true ingress_class_name: nginx host_network: true diff --git a/kubespray/inventory/group_vars/all.yml b/kubespray/inventory/group_vars/all.yml index bc35886..af6aed2 100644 --- a/kubespray/inventory/group_vars/all.yml +++ b/kubespray/inventory/group_vars/all.yml @@ -127,3 +127,8 @@ unsafe_show_logs: false ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases. allow_unsupported_distribution_setup: false + +## Containerd settings +# containerd_metadata_root_dir: /app/lib/containerd +# The state directory for containerd +# containerd_state_dir: /app/run/containerd diff --git a/kubespray/inventory/group_vars/k8s_cluster/addons.yml b/kubespray/inventory/group_vars/k8s_cluster/addons.yml index 92655c1..58ef5da 100644 --- a/kubespray/inventory/group_vars/k8s_cluster/addons.yml +++ b/kubespray/inventory/group_vars/k8s_cluster/addons.yml @@ -83,8 +83,8 @@ rbd_provisioner_enabled: false # rbd_provisioner_reclaim_policy: Delete # Nginx ingress controller deployment -ingress_nginx_enabled: true -ingress_nginx_host_network: true +ingress_nginx_enabled: false +ingress_nginx_host_network: false ingress_publish_status_address: "" # ingress_nginx_nodeselector: # kubernetes.io/os: "linux" @@ -110,7 +110,7 @@ ingress_nginx_secure_port: 443 # ingress_nginx_extra_args: # - --default-ssl-certificate=default/foo-tls # ingress_nginx_termination_grace_period_seconds: 300 -ingress_nginx_class: nginx +ingress_nginx_class: "nginx" # ALB ingress controller deployment ingress_alb_enabled: false @@ -121,7 +121,7 @@ ingress_alb_enabled: false # alb_ingress_aws_debug: "false" # Cert manager deployment -cert_manager_enabled: true +cert_manager_enabled: false # cert_manager_namespace: "cert-manager" # cert_manager_tolerations: # - key: node-role.kubernetes.io/master @@ -150,8 +150,8 @@ cert_manager_enabled: true # cert_manager_dns_policy: "ClusterFirst" cert_manager_dns_config: nameservers: - - "1.1.1.1" - "8.8.8.8" + - "8.8.4.4" # MetalLB deployment metallb_enabled: false @@ -239,12 +239,12 @@ repositories: releases: - - name: longhorn namespace: longhorn-system create_namespace: true chart_ref: kube-forge/longhorn chart_version: 1.6.1 + release_state: "present" values: global: cattle: @@ -726,6 +726,2164 @@ releases: # -- Setting that allows Longhorn to generate code coverage profiles. enableGoCoverDir: false + - name: cert-manager + namespace: cert-manager + create_namespace: true + chart_ref: kube-forge/cert-manager + chart_version: v1.14.5 + release_state: "present" + values: + global: + imagePullSecrets: [] + + commonLabels: {} + + # revisionHistoryLimit: 1 + + priorityClassName: "" + + rbac: + create: true + # Aggregate ClusterRoles to Kubernetes default user-facing roles. Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles + aggregateClusterRoles: true + + podSecurityPolicy: + enabled: false + # Configure the PodSecurityPolicy to use AppArmor + useAppArmor: true + + # Set the verbosity of cert-manager. Range of 0 - 6 with 6 being the most verbose. + logLevel: 2 + + leaderElection: + # Override the namespace used for the leader election lease + namespace: "kube-system" + + # The duration that non-leader candidates will wait after observing a + # leadership renewal until attempting to acquire leadership of a led but + # unrenewed leader slot. This is effectively the maximum duration that a + # leader can be stopped before it is replaced by another candidate. + # leaseDuration: 60s + + # The interval between attempts by the acting master to renew a leadership + # slot before it stops leading. This must be less than or equal to the + # lease duration. + # renewDeadline: 40s + + # The duration the clients should wait between attempting acquisition and + # renewal of a leadership. + # retryPeriod: 15s + + installCRDs: true + + # Number of replicas of the cert-manager controller to run. + # + # The default is 1, but in production you should set this to 2 or 3 to provide high + # availability. + # + # If `replicas > 1` you should also consider setting `podDisruptionBudget.enabled=true`. + # + # Note: cert-manager uses leader election to ensure that there can + # only be a single instance active at a time. + replicaCount: 1 + + # Deployment update strategy for the cert-manager controller deployment. + # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + strategy: {} + + podDisruptionBudget: + # Enable or disable the PodDisruptionBudget resource + # + # This prevents downtime during voluntary disruptions such as during a Node upgrade. + # For example, the PodDisruptionBudget will block `kubectl drain` + # if it is used on the Node where the only remaining cert-manager + # Pod is currently running. + enabled: false + + # Configures the minimum available pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `maxUnavailable` is set. + # +docs:property + # minAvailable: 1 + + # Configures the maximum unavailable pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `minAvailable` is set. + # +docs:property + # maxUnavailable: 1 + + # Comma separated list of feature gates that should be enabled on the + # controller pod. + featureGates: "" + + # The maximum number of challenges that can be scheduled as 'processing' at once + maxConcurrentChallenges: 60 + + image: + # The container registry to pull the manager image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager controller + # +docs:property + repository: quay.io/jetstack/cert-manager-controller + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + tag: v1.14.5 + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + # Override the namespace used to store DNS provider credentials etc. for ClusterIssuer + # resources. By default, the same namespace as cert-manager is deployed within is + # used. This namespace will not be automatically created by the Helm chart. + clusterResourceNamespace: "" + + # This namespace allows you to define where the services will be installed into + # if not set then they will use the namespace of the release + # This is helpful when installing cert manager as a chart dependency (sub chart) + namespace: "" + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the controller's ServiceAccount + # +docs:property + # annotations: {} + + # Optional additional labels to add to the controller's ServiceAccount + # +docs:property + # labels: {} + + # Automount API credentials for a Service Account. + automountServiceAccountToken: true + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + # When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted + enableCertificateOwnerRef: false + + # Used to configure options for the controller pod. + # This allows setting options that'd usually be provided via flags. + # An APIVersion and Kind must be specified in your values.yaml file. + # Flags will override options that are set here. + # + # For example: + # config: + # apiVersion: controller.config.cert-manager.io/v1alpha1 + # kind: ControllerConfiguration + # logging: + # verbosity: 2 + # format: text + # leaderElectionConfig: + # namespace: kube-system + # kubernetesAPIQPS: 9000 + # kubernetesAPIBurst: 9000 + # numberOfConcurrentWorkers: 200 + # featureGates: + # AdditionalCertificateOutputFormats: true + # DisallowInsecureCSRUsageDefinition: true + # ExperimentalCertificateSigningRequestControllers: true + # ExperimentalGatewayAPISupport: true + # LiteralCertificateSubject: true + # SecretsFilteredCaching: true + # ServerSideApply: true + # StableCertificateRequestName: true + # UseCertificateRequestBasicConstraints: true + # ValidateCAA: true + # metricsTLSConfig: + # dynamic: + # secretNamespace: "cert-manager" + # secretName: "cert-manager-metrics-ca" + # dnsNames: + # - cert-manager-metrics + # - cert-manager-metrics.cert-manager + # - cert-manager-metrics.cert-manager.svc + config: {} + + # Setting Nameservers for DNS01 Self Check + # See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check + + # Comma separated string with host and port of the recursive nameservers cert-manager should query + dns01RecursiveNameservers: "" + + # Forces cert-manager to only use the recursive nameservers for verification. + # Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers + dns01RecursiveNameserversOnly: false + + # Additional command line flags to pass to cert-manager controller binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-controller: --help + # + # Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver + # + # For example: + # extraArgs: + # - --controllers=*,-certificaterequests-approver + extraArgs: [] + + # Additional environment variables to pass to cert-manager controller binary. + extraEnv: [] + # - name: SOME_VAR + # value: 'some value' + + # Resources to provide to the cert-manager controller pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + # Pod Security Context + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the controller component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # Optional additional annotations to add to the controller Deployment + # +docs:property + # deploymentAnnotations: {} + + # Optional additional annotations to add to the controller Pods + # +docs:property + # podAnnotations: {} + + # Optional additional labels to add to the controller Pods + podLabels: {} + + # Optional annotations to add to the controller Service + # +docs:property + # serviceAnnotations: {} + + # Optional additional labels to add to the controller Service + # +docs:property + # serviceLabels: {} + + # Optional DNS settings, useful if you have a public and private DNS zone for + # the same domain on Route 53. What follows is an example of ensuring + # cert-manager can access an ingress or DNS TXT records at all times. + # NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for + # the cluster to work. + + # Pod DNS policy + # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy + # +docs:property + # podDnsPolicy: "None" + + # Pod DNS config, podDnsConfig field is optional and it can work with any podDnsPolicy + # settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified. + # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config + # +docs:property + podDnsConfig: + nameservers: + - 1.1.1.1 + - 8.8.8.8 + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # +docs:ignore + ingressShim: {} + + # Optional default issuer to use for ingress resources + # +docs:property=ingressShim.defaultIssuerName + # defaultIssuerName: "" + + # Optional default issuer kind to use for ingress resources + # +docs:property=ingressShim.defaultIssuerKind + # defaultIssuerKind: "" + + # Optional default issuer group to use for ingress resources + # +docs:property=ingressShim.defaultIssuerGroup + # defaultIssuerGroup: "" + + # Use these variables to configure the HTTP_PROXY environment variables + + # Configures the HTTP_PROXY environment variable for where a HTTP proxy is required + # +docs:property + # http_proxy: "http://proxy:8080" + + # Configures the HTTPS_PROXY environment variable for where a HTTP proxy is required + # +docs:property + # https_proxy: "https://proxy:8080" + + # Configures the NO_PROXY environment variable for where a HTTP proxy is required, + # but certain domains should be excluded + # +docs:property + # no_proxy: 127.0.0.1,localhost + + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core + # + # For example: + # topologySpreadConstraints: + # - maxSkew: 2 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: ScheduleAnyway + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: cert-manager + # app.kubernetes.io/component: controller + topologySpreadConstraints: [] + + # LivenessProbe settings for the controller container of the controller Pod. + # + # Enabled by default, because we want to enable the clock-skew liveness probe that + # restarts the controller in case of a skew between the system clock and the monotonic clock. + # LivenessProbe durations and thresholds are based on those used for the Kubernetes + # controller-manager. See: + # https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245 + # +docs:property + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 15 + successThreshold: 1 + failureThreshold: 8 + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false + + # +docs:section=Prometheus + + prometheus: + # Enable Prometheus monitoring for the cert-manager controller to use with the + # Prometheus Operator. If this option is enabled without enabling `prometheus.servicemonitor.enabled` or + # `prometheus.podmonitor.enabled`, 'prometheus.io' annotations are added to the cert-manager Deployment + # resources. Additionally, a service is created which can be used together + # with your own ServiceMonitor (managed outside of this Helm chart). + # Otherwise, a ServiceMonitor/ PodMonitor is created. + enabled: true + servicemonitor: + # Create a ServiceMonitor to add cert-manager to Prometheus + enabled: false + + # Specifies the `prometheus` label on the created ServiceMonitor, this is + # used when different Prometheus instances have label selectors matching + # different ServiceMonitors. + prometheusInstance: default + + # The target port to set on the ServiceMonitor, should match the port that + # cert-manager controller is listening on for metrics + targetPort: 9402 + + # The path to scrape for metrics + path: /metrics + + # The interval to scrape metrics + interval: 60s + + # The timeout before a metrics scrape fails + scrapeTimeout: 30s + + # Additional labels to add to the ServiceMonitor + labels: {} + + # Additional annotations to add to the ServiceMonitor + annotations: {} + + # Keep labels from scraped data, overriding server-side labels. + honorLabels: false + + # EndpointAdditionalProperties allows setting additional properties on the + # endpoint such as relabelings, metricRelabelings etc. + # + # For example: + # endpointAdditionalProperties: + # relabelings: + # - action: replace + # sourceLabels: + # - __meta_kubernetes_pod_node_name + # targetLabel: instance + # + # +docs:property + endpointAdditionalProperties: {} + + # Note: Enabling both PodMonitor and ServiceMonitor is mutually exclusive, enabling both will result in a error. + podmonitor: + # Create a PodMonitor to add cert-manager to Prometheus + enabled: false + + # Specifies the `prometheus` label on the created PodMonitor, this is + # used when different Prometheus instances have label selectors matching + # different PodMonitor. + prometheusInstance: default + + # The path to scrape for metrics + path: /metrics + + # The interval to scrape metrics + interval: 60s + + # The timeout before a metrics scrape fails + scrapeTimeout: 30s + + # Additional labels to add to the PodMonitor + labels: {} + + # Additional annotations to add to the PodMonitor + annotations: {} + + # Keep labels from scraped data, overriding server-side labels. + honorLabels: false + + # EndpointAdditionalProperties allows setting additional properties on the + # endpoint such as relabelings, metricRelabelings etc. + # + # For example: + # endpointAdditionalProperties: + # relabelings: + # - action: replace + # sourceLabels: + # - __meta_kubernetes_pod_node_name + # targetLabel: instance + # + # +docs:property + endpointAdditionalProperties: {} + + # +docs:section=Webhook + + webhook: + # Number of replicas of the cert-manager webhook to run. + # + # The default is 1, but in production you should set this to 2 or 3 to provide high + # availability. + # + # If `replicas > 1` you should also consider setting `webhook.podDisruptionBudget.enabled=true`. + replicaCount: 1 + + # Seconds the API server should wait for the webhook to respond before treating the call as a failure. + # Value must be between 1 and 30 seconds. See: + # https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/ + # + # We set the default to the maximum value of 30 seconds. Here's why: + # Users sometimes report that the connection between the K8S API server and + # the cert-manager webhook server times out. + # If *this* timeout is reached, the error message will be "context deadline exceeded", + # which doesn't help the user diagnose what phase of the HTTPS connection timed out. + # For example, it could be during DNS resolution, TCP connection, TLS + # negotiation, HTTP negotiation, or slow HTTP response from the webhook + # server. + # So by setting this timeout to its maximum value the underlying timeout error + # message has more chance of being returned to the end user. + timeoutSeconds: 30 + + # Used to configure options for the webhook pod. + # This allows setting options that'd usually be provided via flags. + # An APIVersion and Kind must be specified in your values.yaml file. + # Flags will override options that are set here. + # + # For example: + # apiVersion: webhook.config.cert-manager.io/v1alpha1 + # kind: WebhookConfiguration + # # The port that the webhook should listen on for requests. + # # In GKE private clusters, by default kubernetes apiservers are allowed to + # # talk to the cluster nodes only on 443 and 10250. so configuring + # # securePort: 10250, will work out of the box without needing to add firewall + # # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000. + # # This should be uncommented and set as a default by the chart once we graduate + # # the apiVersion of WebhookConfiguration past v1alpha1. + # securePort: 10250 + config: {} + + # Deployment update strategy for the cert-manager webhook deployment. + # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + # + # For example: + # strategy: + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 0 + # maxUnavailable: 1 + strategy: {} + + # Pod Security Context to be set on the webhook component Pod + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the webhook component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + podDisruptionBudget: + # Enable or disable the PodDisruptionBudget resource + # + # This prevents downtime during voluntary disruptions such as during a Node upgrade. + # For example, the PodDisruptionBudget will block `kubectl drain` + # if it is used on the Node where the only remaining cert-manager + # Pod is currently running. + enabled: false + + # Configures the minimum available pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `maxUnavailable` is set. + # +docs:property + # minAvailable: 1 + + # Configures the maximum unavailable pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `minAvailable` is set. + # +docs:property + # maxUnavailable: 1 + + # Optional additional annotations to add to the webhook Deployment + # +docs:property + # deploymentAnnotations: {} + + # Optional additional annotations to add to the webhook Pods + # +docs:property + # podAnnotations: {} + + # Optional additional annotations to add to the webhook Service + # +docs:property + # serviceAnnotations: {} + + # Optional additional annotations to add to the webhook MutatingWebhookConfiguration + # +docs:property + # mutatingWebhookConfigurationAnnotations: {} + + # Optional additional annotations to add to the webhook ValidatingWebhookConfiguration + # +docs:property + # validatingWebhookConfigurationAnnotations: {} + + validatingWebhookConfiguration: + # Configure spec.namespaceSelector for validating webhooks. + # +docs:property + namespaceSelector: + matchExpressions: + - key: "cert-manager.io/disable-validation" + operator: "NotIn" + values: + - "true" + + mutatingWebhookConfiguration: + # Configure spec.namespaceSelector for mutating webhooks. + # +docs:property + namespaceSelector: {} + # matchLabels: + # key: value + # matchExpressions: + # - key: kubernetes.io/metadata.name + # operator: NotIn + # values: + # - kube-system + + + # Additional command line flags to pass to cert-manager webhook binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-webhook: --help + extraArgs: [] + # Path to a file containing a WebhookConfiguration object used to configure the webhook + # - --config= + + # Comma separated list of feature gates that should be enabled on the + # webhook pod. + featureGates: "" + + # Resources to provide to the cert-manager webhook pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + # Liveness probe values + # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + # + # +docs:property + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 60 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + + # Readiness probe values + # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + # + # +docs:property + readinessProbe: + failureThreshold: 3 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 1 + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core + # + # For example: + # topologySpreadConstraints: + # - maxSkew: 2 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: ScheduleAnyway + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: cert-manager + # app.kubernetes.io/component: controller + topologySpreadConstraints: [] + + # Optional additional labels to add to the Webhook Pods + podLabels: {} + + # Optional additional labels to add to the Webhook Service + serviceLabels: {} + + image: + # The container registry to pull the webhook image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager webhook + # +docs:property + repository: quay.io/jetstack/cert-manager-webhook + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the controller's ServiceAccount + # +docs:property + # annotations: {} + + # Optional additional labels to add to the webhook's ServiceAccount + # +docs:property + # labels: {} + + # Automount API credentials for a Service Account. + automountServiceAccountToken: true + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + # The port that the webhook should listen on for requests. + # In GKE private clusters, by default kubernetes apiservers are allowed to + # talk to the cluster nodes only on 443 and 10250. so configuring + # securePort: 10250, will work out of the box without needing to add firewall + # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000 + securePort: 10250 + + # Specifies if the webhook should be started in hostNetwork mode. + # + # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom + # CNI (such as calico), because control-plane managed by AWS cannot communicate + # with pods' IP CIDR and admission webhooks are not working + # + # Since the default port for the webhook conflicts with kubelet on the host + # network, `webhook.securePort` should be changed to an available port if + # running in hostNetwork mode. + hostNetwork: false + + # Specifies how the service should be handled. Useful if you want to expose the + # webhook to outside of the cluster. In some cases, the control plane cannot + # reach internal services. + serviceType: ClusterIP + + # Specify the load balancer IP for the created service + # +docs:property + # loadBalancerIP: "10.10.10.10" + + # Overrides the mutating webhook and validating webhook so they reach the webhook + # service using the `url` field instead of a service. + url: {} + # host: + + # Enables default network policies for webhooks. + networkPolicy: + # Create network policies for the webhooks + enabled: false + + # Ingress rule for the webhook network policy, by default will allow all + # inbound traffic + # +docs:property + ingress: + - from: + - ipBlock: + cidr: 0.0.0.0/0 + + # Egress rule for the webhook network policy, by default will allow all + # outbound traffic traffic to ports 80 and 443, as well as DNS ports + # +docs:property + egress: + - ports: + - port: 80 + protocol: TCP + - port: 443 + protocol: TCP + - port: 53 + protocol: TCP + - port: 53 + protocol: UDP + # On OpenShift and OKD, the Kubernetes API server listens on + # port 6443. + - port: 6443 + protocol: TCP + to: + - ipBlock: + cidr: 0.0.0.0/0 + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false + + # +docs:section=CA Injector + + cainjector: + # Create the CA Injector deployment + enabled: true + + # Number of replicas of the cert-manager cainjector to run. + # + # The default is 1, but in production you should set this to 2 or 3 to provide high + # availability. + # + # If `replicas > 1` you should also consider setting `cainjector.podDisruptionBudget.enabled=true`. + # + # Note: cert-manager uses leader election to ensure that there can + # only be a single instance active at a time. + replicaCount: 1 + + # Used to configure options for the cainjector pod. + # This allows setting options that'd usually be provided via flags. + # An APIVersion and Kind must be specified in your values.yaml file. + # Flags will override options that are set here. + # + # For example: + # apiVersion: cainjector.config.cert-manager.io/v1alpha1 + # kind: CAInjectorConfiguration + # logging: + # verbosity: 2 + # format: text + # leaderElectionConfig: + # namespace: kube-system + config: {} + + # Deployment update strategy for the cert-manager cainjector deployment. + # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + # + # For example: + # strategy: + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 0 + # maxUnavailable: 1 + strategy: {} + + # Pod Security Context to be set on the cainjector component Pod + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the cainjector component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + podDisruptionBudget: + # Enable or disable the PodDisruptionBudget resource + # + # This prevents downtime during voluntary disruptions such as during a Node upgrade. + # For example, the PodDisruptionBudget will block `kubectl drain` + # if it is used on the Node where the only remaining cert-manager + # Pod is currently running. + enabled: false + + # Configures the minimum available pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `maxUnavailable` is set. + # +docs:property + # minAvailable: 1 + + # Configures the maximum unavailable pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `minAvailable` is set. + # +docs:property + # maxUnavailable: 1 + + # Optional additional annotations to add to the cainjector Deployment + # +docs:property + # deploymentAnnotations: {} + + # Optional additional annotations to add to the cainjector Pods + # +docs:property + # podAnnotations: {} + + # Additional command line flags to pass to cert-manager cainjector binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-cainjector: --help + extraArgs: [] + # Enable profiling for cainjector + # - --enable-profiling=true + + # Comma separated list of feature gates that should be enabled on the + # cainjector pod. + featureGates: "" + + # Resources to provide to the cert-manager cainjector pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core + # + # For example: + # topologySpreadConstraints: + # - maxSkew: 2 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: ScheduleAnyway + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: cert-manager + # app.kubernetes.io/component: controller + topologySpreadConstraints: [] + + # Optional additional labels to add to the CA Injector Pods + podLabels: {} + + image: + # The container registry to pull the cainjector image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager cainjector + # +docs:property + repository: quay.io/jetstack/cert-manager-cainjector + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the controller's ServiceAccount + # +docs:property + # annotations: {} + + # Optional additional labels to add to the cainjector's ServiceAccount + # +docs:property + # labels: {} + + # Automount API credentials for a Service Account. + automountServiceAccountToken: true + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false + + # +docs:section=ACME Solver + + acmesolver: + image: + # The container registry to pull the acmesolver image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager acmesolver + # +docs:property + repository: quay.io/jetstack/cert-manager-acmesolver + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + # +docs:section=Startup API Check + # This startupapicheck is a Helm post-install hook that waits for the webhook + # endpoints to become available. + # The check is implemented using a Kubernetes Job - if you are injecting mesh + # sidecar proxies into cert-manager pods, you probably want to ensure that they + # are not injected into this Job's pod. Otherwise the installation may time out + # due to the Job never being completed because the sidecar proxy does not exit. + # See https://github.com/cert-manager/cert-manager/pull/4414 for context. + + startupapicheck: + # Enables the startup api check + enabled: true + + # Pod Security Context to be set on the startupapicheck component Pod + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the controller component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + # Timeout for 'kubectl check api' command + timeout: 1m + + # Job backoffLimit + backoffLimit: 4 + + # Optional additional annotations to add to the startupapicheck Job + # +docs:property + jobAnnotations: + helm.sh/hook: post-install + helm.sh/hook-weight: "1" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + + # Optional additional annotations to add to the startupapicheck Pods + # +docs:property + # podAnnotations: {} + + # Additional command line flags to pass to startupapicheck binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-ctl: --help + # + # We enable verbose logging by default so that if startupapicheck fails, users + # can know what exactly caused the failure. Verbose logs include details of + # the webhook URL, IP address and TCP connect errors for example. + # +docs:property + extraArgs: + - -v + + # Resources to provide to the cert-manager controller pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # Optional additional labels to add to the startupapicheck Pods + podLabels: {} + + image: + # The container registry to pull the startupapicheck image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager startupapicheck + # +docs:property + repository: quay.io/jetstack/cert-manager-startupapicheck + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + rbac: + # annotations for the startup API Check job RBAC and PSP resources + # +docs:property + annotations: + helm.sh/hook: post-install + helm.sh/hook-weight: "-5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the Job's ServiceAccount + # +docs:property + annotations: + helm.sh/hook: post-install + helm.sh/hook-weight: "-5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + + # Automount API credentials for a Service Account. + # +docs:property + automountServiceAccountToken: true + + # Optional additional labels to add to the startupapicheck's ServiceAccount + # +docs:property + # labels: {} + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false + + - name: ingress-nginx + namespace: ingress-nginx + create_namespace: true + chart_ref: kube-forge/ingress-nginx + chart_version: 4.10.1 + release_state: "present" + values: + commonLabels: {} + controller: + name: controller + enableAnnotationValidations: false + image: + ## Keep false as default for now! + chroot: false + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + repository: registry.k8s.io/ingress-nginx/controller + tag: "v1.9.4" + digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3 + digestChroot: sha256:5976b1067cfbca8a21d0ba53d71f83543a73316a61ea7f7e436d6cf84ddf9b26 + pullPolicy: IfNotPresent + # www-data -> uid 101 + runAsUser: 101 + allowPrivilegeEscalation: true + # -- Use an existing PSP instead of creating one + existingPsp: "" + # -- Configures the controller container name + containerName: controller + # -- Configures the ports that the nginx-controller listens on + containerPort: + http: 80 + https: 443 + # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ + config: {} + # -- Annotations to be added to the controller config configuration configmap. + configAnnotations: {} + # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers + proxySetHeaders: {} + # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers + addHeaders: {} + # -- Optionally customize the pod dnsConfig. + dnsConfig: {} + # -- Optionally customize the pod hostAliases. + hostAliases: [] + # - ip: 127.0.0.1 + # hostnames: + # - foo.local + # - bar.local + # - ip: 10.1.2.3 + # hostnames: + # - foo.remote + # - bar.remote + # -- Optionally customize the pod hostname. + hostname: {} + # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. + # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller + # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. + dnsPolicy: ClusterFirst + # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network + # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply + reportNodeInternalIp: false + # -- Process Ingress objects without ingressClass annotation/ingressClassName field + # Overrides value for --watch-ingress-without-class flag of the controller binary + # Defaults to false + watchIngressWithoutClass: false + # -- Process IngressClass per name (additionally as per spec.controller). + ingressClassByName: false + # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" + # Defaults to false + enableTopologyAwareRouting: false + # -- This configuration defines if Ingress Controller should allow users to set + # their own *-snippet annotations, otherwise this is forbidden / dropped + # when users add those annotations. + # Global snippets in ConfigMap are still respected + allowSnippetAnnotations: true + # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), + # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 + # is merged + hostNetwork: true + ## Use host ports 80 and 443 + ## Disabled by default + hostPort: + # -- Enable 'hostPort' or not + enabled: false + ports: + # -- 'hostPort' http port + http: 80 + # -- 'hostPort' https port + https: 443 + # NetworkPolicy for controller component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' + electionID: "" + ## This section refers to the creation of the IngressClass resource + ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19 + ingressClassResource: + # -- Name of the ingressClass + name: nginx + # -- Is this ingressClass enabled or not + enabled: true + # -- Is this the default ingressClass for the cluster + default: false + # -- Controller-value of the controller that is processing this ingressClass + controllerValue: "k8s.io/ingress-nginx" + # -- Parameters is a link to a custom resource containing additional + # configuration for the controller. This is optional if the controller + # does not require extra parameters. + parameters: {} + # -- For backwards compatibility with ingress.class annotation, use ingressClass. + # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation + ingressClass: nginx + # -- Labels to add to the pod container metadata + podLabels: {} + + # -- Security Context policies for controller pods + podSecurityContext: {} + # -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls + sysctls: {} + # sysctls: + # "net.core.somaxconn": "8192" + + # -- Allows customization of the source of the IP address or FQDN to report + # in the ingress status field. By default, it reads the information provided + # by the service. If disable, the status field reports the IP address of the + # node or nodes where an ingress controller pod is running. + publishService: + # -- Enable 'publishService' or not + enabled: true + # -- Allows overriding of the publish service to bind to + # Must be / + pathOverride: "" + # Limit the scope of the controller to a specific namespace + scope: + # -- Enable 'scope' or not + enabled: false + # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) + namespace: "" + # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels + # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. + namespaceSelector: "" + # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + tcp: + # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the tcp config configmap + annotations: {} + udp: + # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the udp config configmap + annotations: {} + # -- Maxmind license key to download GeoLite2 Databases. + ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases + maxmindLicenseKey: "" + # -- Additional command line arguments to pass to Ingress-Nginx Controller + # E.g. to specify the default SSL certificate you can use + extraArgs: {} + ## extraArgs: + ## default-ssl-certificate: "/" + + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + + # -- Use a `DaemonSet` or `Deployment` + kind: DaemonSet + # -- Annotations to be added to the controller Deployment or DaemonSet + ## + annotations: {} + # keel.sh/pollSchedule: "@every 60m" + + # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels + ## + labels: {} + # keel.sh/policy: patch + # keel.sh/trigger: poll + + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + # -- Affinity and anti-affinity rules for server scheduling to nodes + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} + # # An example of preferred pod anti-affinity, weight is in the range 1-100 + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - weight: 100 + # podAffinityTerm: + # labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: kubernetes.io/hostname + + # # An example of required pod anti-affinity + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: "kubernetes.io/hostname" + + # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## + topologySpreadConstraints: [] + + # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready + ## wait up to five minutes for the drain of connections + ## + terminationGracePeriodSeconds: 300 + # -- Node labels for controller pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: + kubernetes.io/os: linux + ## Liveness and readiness probe values + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## + ## startupProbe: + ## httpGet: + ## # should match container.healthCheckPath + ## path: "/healthz" + ## port: 10254 + ## scheme: HTTP + ## initialDelaySeconds: 5 + ## periodSeconds: 5 + ## timeoutSeconds: 2 + ## successThreshold: 1 + ## failureThreshold: 5 + livenessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + # -- Path of the health check endpoint. All requests received on the port defined by + # the healthz-port parameter are forwarded internally to this path. + healthCheckPath: "/healthz" + # -- Address to bind the health check endpoint. + # It is better to set this option to the internal node address + # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. + healthCheckHost: "" + # -- Annotations to be added to controller pods + ## + podAnnotations: {} + replicaCount: 1 + # -- Minimum available pods set in PodDisruptionBudget. + # Define either 'minAvailable' or 'maxUnavailable', never both. + minAvailable: 1 + # -- Maximum unavalaile pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored. + # maxUnavailable: 1 + + ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes + ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 + ## Ideally, there should be no limits. + ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ + resources: + ## limits: + ## cpu: 100m + ## memory: 90Mi + requests: + cpu: 100m + memory: 90Mi + # Mutually exclusive with keda autoscaling + autoscaling: + enabled: false + annotations: {} + minReplicas: 1 + maxReplicas: 11 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + autoscalingTemplate: [] + # Custom or additional autoscaling metrics + # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics + # - type: Pods + # pods: + # metric: + # name: nginx_ingress_controller_nginx_process_requests_total + # target: + # type: AverageValue + # averageValue: 10000m + + # Mutually exclusive with hpa autoscaling + keda: + apiVersion: "keda.sh/v1alpha1" + ## apiVersion changes with keda 1.x vs 2.x + ## 2.x = keda.sh/v1alpha1 + ## 1.x = keda.k8s.io/v1alpha1 + enabled: false + minReplicas: 1 + maxReplicas: 11 + pollingInterval: 30 + cooldownPeriod: 300 + # fallback: + # failureThreshold: 3 + # replicas: 11 + restoreToOriginalReplicaCount: false + scaledObject: + annotations: {} + # Custom annotations for ScaledObject resource + # annotations: + # key: value + triggers: [] + # - type: prometheus + # metadata: + # serverAddress: http://:9090 + # metricName: http_requests_total + # threshold: '100' + # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) + + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + # -- Enable mimalloc as a drop-in replacement for malloc. + ## ref: https://github.com/microsoft/mimalloc + ## + enableMimalloc: true + ## Override NGINX template + customTemplate: + configMapName: "" + configMapKey: "" + service: + enabled: true + # -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were + # using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http + # It allows choosing the protocol for each backend specified in the Kubernetes service. + # See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244 + # Will be ignored for Kubernetes versions older than 1.20 + ## + appProtocol: true + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. + annotations: {} + labels: {} + # clusterIP: "" + + # -- List of IP addresses at which the controller services are available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + loadBalancerIP: "" + loadBalancerSourceRanges: [] + # -- Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + loadBalancerClass: "" + enableHttp: true + enableHttps: true + ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it. + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" + + ## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None". + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + # sessionAffinity: "" + + ## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified, + ## the service controller allocates a port from your cluster’s NodePort range. + ## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + # healthCheckNodePort: 0 + + # -- Represents the dual-stack-ness requested or required by this Service. Possible values are + # SingleStack, PreferDualStack or RequireDualStack. + # The ipFamilies and clusterIPs fields depend on the value of this field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilyPolicy: "SingleStack" + # -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically + # based on cluster configuration and the ipFamilyPolicy field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilies: + - IPv4 + ports: + http: 80 + https: 443 + targetPorts: + http: http + https: https + type: "" + # type: NodePort + # nodePorts: + # http: 32080 + # https: 32443 + # tcp: + # 8080: 32808 + nodePorts: + http: "" + https: "" + tcp: {} + udp: {} + external: + enabled: true + internal: + # -- Enables an additional internal load balancer (besides the external one). + enabled: false + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. + annotations: {} + # -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. + loadBalancerIP: "" + # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. + loadBalancerSourceRanges: [] + ## Set external traffic policy to: "Local" to preserve source IP on + ## providers supporting it + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" + + # -- Custom port mapping for internal service + ports: {} + # http: 80 + # https: 443 + + # -- Custom target port mapping for internal service + targetPorts: {} + # http: http + # https: https + # shareProcessNamespace enables process namespace sharing within the pod. + # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. + shareProcessNamespace: false + # -- Additional containers to be added to the controller pod. + # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. + extraContainers: [] + # - name: my-sidecar + # image: nginx:latest + # - name: lemonldap-ng-controller + # image: lemonldapng/lemonldap-ng-controller:0.2.0 + # args: + # - /lemonldap-ng-controller + # - --alsologtostderr + # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration + # env: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + # - name: POD_NAMESPACE + # valueFrom: + # fieldRef: + # fieldPath: metadata.namespace + # volumeMounts: + # - name: copy-portal-skins + # mountPath: /srv/var/lib/lemonldap-ng/portal/skins + + # -- Additional volumeMounts to the controller main container. + extraVolumeMounts: [] + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + # -- Additional volumes to the controller pod. + extraVolumes: [] + # - name: copy-portal-skins + # emptyDir: {} + + # -- Containers, which are run before the app containers are started. + extraInitContainers: [] + # - name: init-myservice + # image: busybox + # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] + + # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module + extraModules: [] + # - name: mytestmodule + # image: registry.k8s.io/ingress-nginx/mytestmodule + # containerSecurityContext: + # allowPrivilegeEscalation: false + # + # The image must contain a `/usr/local/bin/init_module.sh` executable, which + # will be executed as initContainers, to move its config files within the + # mounted volume. + + opentelemetry: + enabled: false + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472 + containerSecurityContext: + allowPrivilegeEscalation: false + resources: {} + admissionWebhooks: + annotations: {} + # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". + + ## Additional annotations to the admission webhooks. + ## These annotations will be added to the ValidatingWebhookConfiguration and + ## the Jobs Spec of the admission webhooks. + enabled: false + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + # -- Admission Webhook failure policy to use + failurePolicy: Fail + # timeoutSeconds: 10 + port: 8443 + certificate: "/usr/local/certificates/cert" + key: "/usr/local/certificates/key" + namespaceSelector: {} + objectSelector: {} + # -- Labels to be added to admission webhooks + labels: {} + # -- Use an existing PSP instead of creating one + existingPsp: "" + service: + annotations: {} + # clusterIP: "" + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 443 + type: ClusterIP + createSecretJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + patchWebhookJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + patch: + enabled: true + image: + registry: registry.k8s.io + image: ingress-nginx/kube-webhook-certgen + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: v20231011-8b53cabe0 + digest: sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 + pullPolicy: IfNotPresent + # -- Provide a priority class name to the webhook patching job + ## + priorityClassName: "" + podAnnotations: {} + nodeSelector: + kubernetes.io/os: linux + tolerations: [] + # -- Labels to be added to patch job resources + labels: {} + securityContext: + runAsNonRoot: true + runAsUser: 2000 + fsGroup: 2000 + # Use certmanager to generate webhook certs + certManager: + enabled: false + # self-signed root certificate + rootCert: + # default to be 5y + duration: "" + admissionCert: + # default to be 1y + duration: "" + # issuerRef: + # name: "issuer" + # kind: "ClusterIssuer" + metrics: + port: 10254 + portName: metrics + # if this port is changed, change healthz-port: in extraArgs: accordingly + enabled: false + service: + annotations: {} + # prometheus.io/scrape: "true" + # prometheus.io/port: "10254" + # -- Labels to be added to the metrics service resource + labels: {} + # clusterIP: "" + + # -- List of IP addresses at which the stats-exporter service is available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 10254 + type: ClusterIP + # externalTrafficPolicy: "" + # nodePort: "" + serviceMonitor: + enabled: false + additionalLabels: {} + ## The label to use to retrieve the job name from. + ## jobLabel: "app.kubernetes.io/name" + namespace: "" + namespaceSelector: {} + ## Default: scrape .Release.Namespace or namespaceOverride only + ## To scrape all, use the following: + ## namespaceSelector: + ## any: true + scrapeInterval: 30s + # honorLabels: true + targetLabels: [] + relabelings: [] + metricRelabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + # namespace: "" + rules: [] + # # These are just examples rules, please adapt them to your needs + # - alert: NGINXConfigFailed + # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: bad ingress config - nginx config test failed + # summary: uninstall the latest ingress changes to allow config reloads to resume + # - alert: NGINXCertificateExpiry + # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: ssl certificate(s) will expire in less then a week + # summary: renew expiring certificates to avoid downtime + # - alert: NGINXTooMany500s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 5XXs + # summary: More than 5% of all requests returned 5XX, this requires your attention + # - alert: NGINXTooMany400s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 4XXs + # summary: More than 5% of all requests returned 4XX, this requires your attention + # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: + # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds + # to 300, allowing the draining of connections up to five minutes. + # If the active connections end before that, the pod will terminate gracefully at that time. + # To effectively take advantage of this feature, the Configmap feature + # worker-shutdown-timeout new value is 240s instead of 10s. + ## + lifecycle: + preStop: + exec: + command: + - /wait-shutdown + priorityClassName: "" + # -- Rollback limit + ## + revisionHistoryLimit: 10 + ## Default 404 backend + ## + defaultBackend: + ## + enabled: false + name: defaultbackend + image: + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + repository: registry.k8s.io/defaultbackend-amd64 + tag: "1.5" + pullPolicy: IfNotPresent + # nobody user -> uid 65534 + runAsUser: 65534 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + # -- Use an existing PSP instead of creating one + existingPsp: "" + extraArgs: {} + serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Additional environment variables to set for defaultBackend pods + extraEnvs: [] + port: 8080 + ## Readiness and liveness probes for default backend + ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ + ## + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + failureThreshold: 6 + initialDelaySeconds: 0 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + affinity: {} + # -- Security Context policies for controller pods + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + podSecurityContext: {} + # -- Security Context policies for controller main container. + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + containerSecurityContext: {} + # -- Labels to add to the pod container metadata + podLabels: {} + # -- Node labels for default backend pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: + kubernetes.io/os: linux + # -- Annotations to be added to default backend pods + ## + podAnnotations: {} + replicaCount: 1 + minAvailable: 1 + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + + extraVolumeMounts: [] + ## Additional volumeMounts to the default backend container. + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + extraVolumes: [] + ## Additional volumes to the default backend pod. + # - name: copy-portal-skins + # emptyDir: {} + + autoscaling: + annotations: {} + enabled: false + minReplicas: 1 + maxReplicas: 2 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + # NetworkPolicy for default backend component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + service: + annotations: {} + # clusterIP: "" + + # -- List of IP addresses at which the default backend service is available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 80 + type: ClusterIP + priorityClassName: "" + # -- Labels to be added to the default backend resources + labels: {} + ## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 + rbac: + create: true + scope: false + ## If true, create & use Pod Security Policy resources + ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + podSecurityPolicy: + enabled: false + serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Annotations for the controller service account + annotations: {} + # -- Optional array of imagePullSecrets containing private registry credentials + ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + imagePullSecrets: [] + # - name: secretName + + # -- TCP service key-value pairs + ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md + ## + tcp: {} + # 8080: "default/example-tcp-svc:9000" + + # -- UDP service key-value pairs + ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md + ## + udp: {} + # 53: "kube-system/kube-dns:53" + + # -- Prefix for TCP and UDP ports names in ingress controller service + ## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration + portNamePrefix: "" + # -- (string) A base64-encoded Diffie-Hellman parameter. + # This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` + ## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param + dhParam: "" + - name: csi-secrets-store namespace: kube-system @@ -1239,9 +3397,77 @@ releases: scrapeInterval: 15s retention: 7d # serviceNodePort: 30008 + additionalConfigs: | + - job_name: "kubelet" + scheme: https + metrics_path: /metrics/cadvisor + tls_config: + insecure_skip_verify: true + authorization: + credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token + kubernetes_sd_configs: + - role: node + relabel_configs: + - action: labelmap + regex: __meta_kubernetes_node_label_(.+) + + - job_name: "kubernetes-apiservers" + kubernetes_sd_configs: + - role: endpoints + scheme: https + tls_config: + ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + authorization: + credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token + relabel_configs: + - source_labels: + [ + __meta_kubernetes_namespace, + __meta_kubernetes_service_name, + __meta_kubernetes_endpoint_port_name, + ] + action: keep + regex: default;kubernetes;https + + - job_name: "coredns" + kubernetes_sd_configs: + - role: endpoints + scheme: http + relabel_configs: + - source_labels: + [ + __meta_kubernetes_namespace, + __meta_kubernetes_service_name, + __meta_kubernetes_endpoint_port_name, + ] + action: keep + regex: kube-system;.*dns.*;metrics + + - job_name: 'ingress-endpoints' + metrics_path: /probe + params: + module: [https_ok] + kubernetes_sd_configs: + - role: ingress + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - source_labels: + [ + __meta_kubernetes_ingress_scheme, + __address__, + __meta_kubernetes_ingress_path, + ] + regex: (.+);(.+);(.+) + replacement: https://${2}${3} + target_label: __param_target + - target_label: __address__ + replacement: observability-blackbox-exporter:9115 alertManager: - enabled: false + enabled: true serviceMonitor: true enableDefaultRules: true image: @@ -1252,13 +3478,31 @@ releases: # serviceNodePort: 30009 configPath: /etc/alertmanager - route: - null - + group_wait: 1s + receiver: kvazaric_notifications + repeat_interval: 180m + routes: + - group_by: + - alertname + group_wait: 1s + matchers: + - fireOnce=true + receiver: kvazaric_notifications + repeat_interval: 8737h receivers: - null - + - name: kvazaric_notifications + telegram_configs: + - api_url: https://api.telegram.org + bot_token: 6364937365:AAHcJKc-McN11gBWuQqoM87zr18eK0VKX9I + chat_id: -968770779 + http_config: + enable_http2: false + follow_redirects: true + message: '{% raw %}{{ "{{" }} template "default-message" . {{ "}}" }}{% endraw + %}' + parse_mode: HTML + send_resolved: true blackboxExporter: enabled: true @@ -1961,7 +4205,7 @@ releases: server.insecure: true secret: - argocdServerAdminPassword: $2a$10$uVEAEmc8bmtQYsa3206a7OkI5oHkNWluS9s5szXsNUsgmKvY2jGZy + argocdServerAdminPassword: $2a$10$uCcC.iMBL3IXOHeIB/HSLOvB8WpZprJPA4dEmaNjU4wmDbPXxwMvK repositories: # add default helm-repository from harbor diff --git a/kubespray/project/cluster.yml b/kubespray/project/cluster.yml index bc3e4ed..25dbd20 100644 --- a/kubespray/project/cluster.yml +++ b/kubespray/project/cluster.yml @@ -90,11 +90,7 @@ - { role: kubernetes-apps/ingress_controller, tags: ingress-controller } - { role: kubernetes-apps/external_provisioner, tags: external-provisioner } - { role: kubernetes-apps, tags: apps } - - { - role: helm-apps, - when: "releases is defined and repositories is defined", - tags: helm-apps, - } + - { role: helm-apps, tags: helm-apps } - name: Apply resolv.conf changes now that cluster DNS is up hosts: k8s_cluster diff --git a/pkg/config/modules_additional.go b/pkg/config/modules_additional.go index 7f21009..1f424d8 100644 --- a/pkg/config/modules_additional.go +++ b/pkg/config/modules_additional.go @@ -2,18 +2,32 @@ package config type Additional struct { CertManager struct { - Install bool `yaml:"install"` + Enabled bool `yaml:"enabled"` + HaEnabled bool `yaml:"ha_enabled"` DnsServers []string `yaml:"dns_servers" env-default:"[8.8.8.8,1.1.1.1]"` AccountEmail string `yaml:"account_email"` + Controller struct { + Image string `yaml:"image" env-default:"quay.io/jetstack/cert-manager-controller"` + Tag string `yaml:"tag" env-default:"v1.14.5"` + } `yaml:"controller"` } `yaml:"cert_manager"` Ingress struct { - Type string `yaml:"type" env-default:"nginx"` - Install bool `yaml:"install" env-default:"false"` - InsecurePort int `yaml:"insecure_port" env-default:"80"` - SecurePort int `yaml:"secure_port" env-default:"443"` - IngressClassName string `yaml:"ingress_class_name" env-default:"nginx"` - HostNetwork string `yaml:"host_network" env-default:"false"` + Type string `yaml:"type" env-default:"nginx"` + Enabled bool `yaml:"enabled"` + IngressClassName string `yaml:"ingress_class_name" env-default:"nginx"` + HostNetwork bool `yaml:"host_network"` + EnableAdmissionWebhooks bool `yaml:"enable_admission_webhooks"` + Nginx struct { + Controller struct { + Image string `yaml:"image" env-default:"registry.k8s.io/ingress-nginx/controller"` + Tag string `yaml:"tag" env-default:"v1.9.4"` + } `yaml:"controller"` + DefaultBackend struct { + Image string `yaml:"image" env-default:"registry.k8s.io/defaultbackend-amd64"` + Tag string `yaml:"tag" env-default:"1.5"` + } `yaml:"default_backend"` + } `yaml:"nginx"` } `yaml:"ingress"` LoadBalancer struct { diff --git a/pkg/config/modules_observability.go b/pkg/config/modules_observability.go index 0de2459..ae09d4a 100644 --- a/pkg/config/modules_observability.go +++ b/pkg/config/modules_observability.go @@ -104,17 +104,18 @@ type Monitoring struct { } `yaml:"operator"` } `yaml:"prometheus"` AlertManager struct { - Enabled bool `yaml:"enabled"` - Image string `yaml:"image" env-default:"prom/alertmanager"` - Tag string `yaml:"tag" env-default:"v0.26.0"` - Route interface{} `yaml:"route"` - Receivers interface{} `yaml:"receivers"` + Enabled bool `yaml:"enabled"` + Image string `yaml:"image" env-default:"prom/alertmanager"` + Tag string `yaml:"tag" env-default:"v0.26.0"` + AdditionalMessageTemplates interface{} `yaml:"additionalMessageTemplates"` + Route interface{} `yaml:"route"` + Receivers interface{} `yaml:"receivers"` } `yaml:"alert_manager"` Blackbox struct { Enabled bool `yaml:"enabled"` Image string `yaml:"image" env-default:"prom/blackbox-exporter"` Tag string `yaml:"tag" env-default:"v0.24.0"` - additionalModules string `yaml:"routes" env-default:""` + AdditionalModules string `yaml:"routes" env-default:""` } `yaml:"blackbox"` KubeState struct { Enabled bool `yaml:"enabled"` diff --git a/pkg/config/orchestrator.go b/pkg/config/orchestrator.go index 77015e6..132ecaf 100644 --- a/pkg/config/orchestrator.go +++ b/pkg/config/orchestrator.go @@ -21,7 +21,7 @@ type Orchestrator struct { PingAccessIp bool `yaml:"ping_access_ip" env-default:"true"` AutoRenewCertificates bool `yaml:"auto_renew_certificates" env-default:"false"` EventTtl string `yaml:"event_ttl" env-default:"1h0m0s"` - PodSecurotyPolicyEnabled bool `yaml:"pod_security_policy_enabled" env-default:"false"` + PodSecurityPolicyEnabled bool `yaml:"pod_security_policy_enabled" env-default:"false"` Network struct { Plugin string `yaml:"plugin" env-default:"calico"` diff --git a/pkg/kubespray/cluster.go b/pkg/kubespray/cluster.go index a836e3f..06a6dfa 100644 --- a/pkg/kubespray/cluster.go +++ b/pkg/kubespray/cluster.go @@ -8,6 +8,6 @@ func UpgradeCluster(tags string) { runPlaybook("kubespray/project/upgrade_cluster.yml", tags) } -func ResetCluster() { - runPlaybook("kubespray/project/reset.yml", "reset") +func ScaleCluster() { + runPlaybook("kubespray/project/scale.yml", "") } diff --git a/pkg/kubespray/utility.go b/pkg/kubespray/utility.go index 1ddc969..eba9b46 100644 --- a/pkg/kubespray/utility.go +++ b/pkg/kubespray/utility.go @@ -16,7 +16,7 @@ func getPlaybookParameters(tags string) playbook.AnsiblePlaybookOptions { cfg := config.GetConfig() ansiblePlaybookOptions := playbook.AnsiblePlaybookOptions{ - Inventory: "kubespray/inventory/hosts", + Inventory: filepath.Join(cfg.DataDir, "kubespray/inventory/hosts"), Tags: tags, User: cfg.Credentials.User, Become: true, diff --git a/pkg/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl b/pkg/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl index e69de29..f73541a 100644 --- a/pkg/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl +++ b/pkg/resources/templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl @@ -0,0 +1,1267 @@ +- name: cert-manager + namespace: cert-manager + create_namespace: true + chart_ref: kube-forge/cert-manager + chart_version: v1.14.5 + {{- if .Modules.Additional.CertManager.Enabled }} + release_state: "present" + {{- else }} + release_state: "absent" + {{- end }} + values: + global: + imagePullSecrets: [] + + commonLabels: {} + + # revisionHistoryLimit: 1 + + priorityClassName: "" + + rbac: + create: true + # Aggregate ClusterRoles to Kubernetes default user-facing roles. Ref: https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles + aggregateClusterRoles: true + + podSecurityPolicy: + enabled: false + # Configure the PodSecurityPolicy to use AppArmor + useAppArmor: true + + # Set the verbosity of cert-manager. Range of 0 - 6 with 6 being the most verbose. + logLevel: 2 + + leaderElection: + # Override the namespace used for the leader election lease + namespace: "kube-system" + + # The duration that non-leader candidates will wait after observing a + # leadership renewal until attempting to acquire leadership of a led but + # unrenewed leader slot. This is effectively the maximum duration that a + # leader can be stopped before it is replaced by another candidate. + # leaseDuration: 60s + + # The interval between attempts by the acting master to renew a leadership + # slot before it stops leading. This must be less than or equal to the + # lease duration. + # renewDeadline: 40s + + # The duration the clients should wait between attempting acquisition and + # renewal of a leadership. + # retryPeriod: 15s + + installCRDs: true + + # Number of replicas of the cert-manager controller to run. + # + # The default is 1, but in production you should set this to 2 or 3 to provide high + # availability. + # + # If `replicas > 1` you should also consider setting `podDisruptionBudget.enabled=true`. + # + # Note: cert-manager uses leader election to ensure that there can + # only be a single instance active at a time. + {{- if .Modules.Additional.CertManager.HaEnabled }} + replicaCount: 3 + {{- else }} + replicaCount: 1 + {{- end }} + + # Deployment update strategy for the cert-manager controller deployment. + # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + strategy: {} + + podDisruptionBudget: + # Enable or disable the PodDisruptionBudget resource + # + # This prevents downtime during voluntary disruptions such as during a Node upgrade. + # For example, the PodDisruptionBudget will block `kubectl drain` + # if it is used on the Node where the only remaining cert-manager + # Pod is currently running. + enabled: false + + # Configures the minimum available pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `maxUnavailable` is set. + # +docs:property + # minAvailable: 1 + + # Configures the maximum unavailable pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `minAvailable` is set. + # +docs:property + # maxUnavailable: 1 + + # Comma separated list of feature gates that should be enabled on the + # controller pod. + featureGates: "" + + # The maximum number of challenges that can be scheduled as 'processing' at once + maxConcurrentChallenges: 60 + + image: + # The container registry to pull the manager image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager controller + # +docs:property + repository: {{ .Modules.Additional.CertManager.Controller.Image }} + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + tag: {{ .Modules.Additional.CertManager.Controller.Tag }} + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + # Override the namespace used to store DNS provider credentials etc. for ClusterIssuer + # resources. By default, the same namespace as cert-manager is deployed within is + # used. This namespace will not be automatically created by the Helm chart. + clusterResourceNamespace: "" + + # This namespace allows you to define where the services will be installed into + # if not set then they will use the namespace of the release + # This is helpful when installing cert manager as a chart dependency (sub chart) + namespace: "" + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the controller's ServiceAccount + # +docs:property + # annotations: {} + + # Optional additional labels to add to the controller's ServiceAccount + # +docs:property + # labels: {} + + # Automount API credentials for a Service Account. + automountServiceAccountToken: true + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + # When this flag is enabled, secrets will be automatically removed when the certificate resource is deleted + enableCertificateOwnerRef: false + + # Used to configure options for the controller pod. + # This allows setting options that'd usually be provided via flags. + # An APIVersion and Kind must be specified in your values.yaml file. + # Flags will override options that are set here. + # + # For example: + # config: + # apiVersion: controller.config.cert-manager.io/v1alpha1 + # kind: ControllerConfiguration + # logging: + # verbosity: 2 + # format: text + # leaderElectionConfig: + # namespace: kube-system + # kubernetesAPIQPS: 9000 + # kubernetesAPIBurst: 9000 + # numberOfConcurrentWorkers: 200 + # featureGates: + # AdditionalCertificateOutputFormats: true + # DisallowInsecureCSRUsageDefinition: true + # ExperimentalCertificateSigningRequestControllers: true + # ExperimentalGatewayAPISupport: true + # LiteralCertificateSubject: true + # SecretsFilteredCaching: true + # ServerSideApply: true + # StableCertificateRequestName: true + # UseCertificateRequestBasicConstraints: true + # ValidateCAA: true + # metricsTLSConfig: + # dynamic: + # secretNamespace: "cert-manager" + # secretName: "cert-manager-metrics-ca" + # dnsNames: + # - cert-manager-metrics + # - cert-manager-metrics.cert-manager + # - cert-manager-metrics.cert-manager.svc + config: {} + + # Setting Nameservers for DNS01 Self Check + # See: https://cert-manager.io/docs/configuration/acme/dns01/#setting-nameservers-for-dns01-self-check + + # Comma separated string with host and port of the recursive nameservers cert-manager should query + dns01RecursiveNameservers: "" + + # Forces cert-manager to only use the recursive nameservers for verification. + # Enabling this option could cause the DNS01 self check to take longer due to caching performed by the recursive nameservers + dns01RecursiveNameserversOnly: false + + # Additional command line flags to pass to cert-manager controller binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-controller: --help + # + # Use this flag to enable or disable arbitrary controllers, for example, disable the CertificiateRequests approver + # + # For example: + # extraArgs: + # - --controllers=*,-certificaterequests-approver + extraArgs: [] + + # Additional environment variables to pass to cert-manager controller binary. + extraEnv: [] + # - name: SOME_VAR + # value: 'some value' + + # Resources to provide to the cert-manager controller pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + # Pod Security Context + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the controller component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # Optional additional annotations to add to the controller Deployment + # +docs:property + # deploymentAnnotations: {} + + # Optional additional annotations to add to the controller Pods + # +docs:property + # podAnnotations: {} + + # Optional additional labels to add to the controller Pods + podLabels: {} + + # Optional annotations to add to the controller Service + # +docs:property + # serviceAnnotations: {} + + # Optional additional labels to add to the controller Service + # +docs:property + # serviceLabels: {} + + # Optional DNS settings, useful if you have a public and private DNS zone for + # the same domain on Route 53. What follows is an example of ensuring + # cert-manager can access an ingress or DNS TXT records at all times. + # NOTE: This requires Kubernetes 1.10 or `CustomPodDNS` feature gate enabled for + # the cluster to work. + + # Pod DNS policy + # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-s-dns-policy + # +docs:property + # podDnsPolicy: "None" + + # Pod DNS config, podDnsConfig field is optional and it can work with any podDnsPolicy + # settings. However, when a Pod's dnsPolicy is set to "None", the dnsConfig field has to be specified. + # ref: https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pod-dns-config + # +docs:property + podDnsConfig: + nameservers: + {{- .Modules.Additional.CertManager.DnsServers | toYaml | nindent 8 }} + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # +docs:ignore + ingressShim: {} + + # Optional default issuer to use for ingress resources + # +docs:property=ingressShim.defaultIssuerName + # defaultIssuerName: "" + + # Optional default issuer kind to use for ingress resources + # +docs:property=ingressShim.defaultIssuerKind + # defaultIssuerKind: "" + + # Optional default issuer group to use for ingress resources + # +docs:property=ingressShim.defaultIssuerGroup + # defaultIssuerGroup: "" + + # Use these variables to configure the HTTP_PROXY environment variables + + # Configures the HTTP_PROXY environment variable for where a HTTP proxy is required + # +docs:property + # http_proxy: "http://proxy:8080" + + # Configures the HTTPS_PROXY environment variable for where a HTTP proxy is required + # +docs:property + # https_proxy: "https://proxy:8080" + + # Configures the NO_PROXY environment variable for where a HTTP proxy is required, + # but certain domains should be excluded + # +docs:property + # no_proxy: 127.0.0.1,localhost + + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core + # + # For example: + # topologySpreadConstraints: + # - maxSkew: 2 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: ScheduleAnyway + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: cert-manager + # app.kubernetes.io/component: controller + topologySpreadConstraints: [] + + # LivenessProbe settings for the controller container of the controller Pod. + # + # Enabled by default, because we want to enable the clock-skew liveness probe that + # restarts the controller in case of a skew between the system clock and the monotonic clock. + # LivenessProbe durations and thresholds are based on those used for the Kubernetes + # controller-manager. See: + # https://github.com/kubernetes/kubernetes/blob/806b30170c61a38fedd54cc9ede4cd6275a1ad3b/cmd/kubeadm/app/util/staticpod/utils.go#L241-L245 + # +docs:property + livenessProbe: + enabled: true + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 15 + successThreshold: 1 + failureThreshold: 8 + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false + + # +docs:section=Prometheus + + prometheus: + # Enable Prometheus monitoring for the cert-manager controller to use with the + # Prometheus Operator. If this option is enabled without enabling `prometheus.servicemonitor.enabled` or + # `prometheus.podmonitor.enabled`, 'prometheus.io' annotations are added to the cert-manager Deployment + # resources. Additionally, a service is created which can be used together + # with your own ServiceMonitor (managed outside of this Helm chart). + # Otherwise, a ServiceMonitor/ PodMonitor is created. + enabled: true + servicemonitor: + # Create a ServiceMonitor to add cert-manager to Prometheus + enabled: false + + # Specifies the `prometheus` label on the created ServiceMonitor, this is + # used when different Prometheus instances have label selectors matching + # different ServiceMonitors. + prometheusInstance: default + + # The target port to set on the ServiceMonitor, should match the port that + # cert-manager controller is listening on for metrics + targetPort: 9402 + + # The path to scrape for metrics + path: /metrics + + # The interval to scrape metrics + interval: 60s + + # The timeout before a metrics scrape fails + scrapeTimeout: 30s + + # Additional labels to add to the ServiceMonitor + labels: {} + + # Additional annotations to add to the ServiceMonitor + annotations: {} + + # Keep labels from scraped data, overriding server-side labels. + honorLabels: false + + # EndpointAdditionalProperties allows setting additional properties on the + # endpoint such as relabelings, metricRelabelings etc. + # + # For example: + # endpointAdditionalProperties: + # relabelings: + # - action: replace + # sourceLabels: + # - __meta_kubernetes_pod_node_name + # targetLabel: instance + # + # +docs:property + endpointAdditionalProperties: {} + + # Note: Enabling both PodMonitor and ServiceMonitor is mutually exclusive, enabling both will result in a error. + podmonitor: + # Create a PodMonitor to add cert-manager to Prometheus + enabled: false + + # Specifies the `prometheus` label on the created PodMonitor, this is + # used when different Prometheus instances have label selectors matching + # different PodMonitor. + prometheusInstance: default + + # The path to scrape for metrics + path: /metrics + + # The interval to scrape metrics + interval: 60s + + # The timeout before a metrics scrape fails + scrapeTimeout: 30s + + # Additional labels to add to the PodMonitor + labels: {} + + # Additional annotations to add to the PodMonitor + annotations: {} + + # Keep labels from scraped data, overriding server-side labels. + honorLabels: false + + # EndpointAdditionalProperties allows setting additional properties on the + # endpoint such as relabelings, metricRelabelings etc. + # + # For example: + # endpointAdditionalProperties: + # relabelings: + # - action: replace + # sourceLabels: + # - __meta_kubernetes_pod_node_name + # targetLabel: instance + # + # +docs:property + endpointAdditionalProperties: {} + + # +docs:section=Webhook + + webhook: + # Number of replicas of the cert-manager webhook to run. + # + # The default is 1, but in production you should set this to 2 or 3 to provide high + # availability. + # + # If `replicas > 1` you should also consider setting `webhook.podDisruptionBudget.enabled=true`. + {{- if .Modules.Additional.CertManager.HaEnabled }} + replicaCount: 3 + {{- else }} + replicaCount: 1 + {{- end }} + + # Seconds the API server should wait for the webhook to respond before treating the call as a failure. + # Value must be between 1 and 30 seconds. See: + # https://kubernetes.io/docs/reference/kubernetes-api/extend-resources/validating-webhook-configuration-v1/ + # + # We set the default to the maximum value of 30 seconds. Here's why: + # Users sometimes report that the connection between the K8S API server and + # the cert-manager webhook server times out. + # If *this* timeout is reached, the error message will be "context deadline exceeded", + # which doesn't help the user diagnose what phase of the HTTPS connection timed out. + # For example, it could be during DNS resolution, TCP connection, TLS + # negotiation, HTTP negotiation, or slow HTTP response from the webhook + # server. + # So by setting this timeout to its maximum value the underlying timeout error + # message has more chance of being returned to the end user. + timeoutSeconds: 30 + + # Used to configure options for the webhook pod. + # This allows setting options that'd usually be provided via flags. + # An APIVersion and Kind must be specified in your values.yaml file. + # Flags will override options that are set here. + # + # For example: + # apiVersion: webhook.config.cert-manager.io/v1alpha1 + # kind: WebhookConfiguration + # # The port that the webhook should listen on for requests. + # # In GKE private clusters, by default kubernetes apiservers are allowed to + # # talk to the cluster nodes only on 443 and 10250. so configuring + # # securePort: 10250, will work out of the box without needing to add firewall + # # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers < 1000. + # # This should be uncommented and set as a default by the chart once we graduate + # # the apiVersion of WebhookConfiguration past v1alpha1. + # securePort: 10250 + config: {} + + # Deployment update strategy for the cert-manager webhook deployment. + # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + # + # For example: + # strategy: + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 0 + # maxUnavailable: 1 + strategy: {} + + # Pod Security Context to be set on the webhook component Pod + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the webhook component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + podDisruptionBudget: + # Enable or disable the PodDisruptionBudget resource + # + # This prevents downtime during voluntary disruptions such as during a Node upgrade. + # For example, the PodDisruptionBudget will block `kubectl drain` + # if it is used on the Node where the only remaining cert-manager + # Pod is currently running. + enabled: false + + # Configures the minimum available pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `maxUnavailable` is set. + # +docs:property + # minAvailable: 1 + + # Configures the maximum unavailable pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `minAvailable` is set. + # +docs:property + # maxUnavailable: 1 + + # Optional additional annotations to add to the webhook Deployment + # +docs:property + # deploymentAnnotations: {} + + # Optional additional annotations to add to the webhook Pods + # +docs:property + # podAnnotations: {} + + # Optional additional annotations to add to the webhook Service + # +docs:property + # serviceAnnotations: {} + + # Optional additional annotations to add to the webhook MutatingWebhookConfiguration + # +docs:property + # mutatingWebhookConfigurationAnnotations: {} + + # Optional additional annotations to add to the webhook ValidatingWebhookConfiguration + # +docs:property + # validatingWebhookConfigurationAnnotations: {} + + validatingWebhookConfiguration: + # Configure spec.namespaceSelector for validating webhooks. + # +docs:property + namespaceSelector: + matchExpressions: + - key: "cert-manager.io/disable-validation" + operator: "NotIn" + values: + - "true" + + mutatingWebhookConfiguration: + # Configure spec.namespaceSelector for mutating webhooks. + # +docs:property + namespaceSelector: {} + # matchLabels: + # key: value + # matchExpressions: + # - key: kubernetes.io/metadata.name + # operator: NotIn + # values: + # - kube-system + + + # Additional command line flags to pass to cert-manager webhook binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-webhook: --help + extraArgs: [] + # Path to a file containing a WebhookConfiguration object used to configure the webhook + # - --config= + + # Comma separated list of feature gates that should be enabled on the + # webhook pod. + featureGates: "" + + # Resources to provide to the cert-manager webhook pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + # Liveness probe values + # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + # + # +docs:property + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 60 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 1 + + # Readiness probe values + # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + # + # +docs:property + readinessProbe: + failureThreshold: 3 + initialDelaySeconds: 5 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 1 + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core + # + # For example: + # topologySpreadConstraints: + # - maxSkew: 2 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: ScheduleAnyway + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: cert-manager + # app.kubernetes.io/component: controller + topologySpreadConstraints: [] + + # Optional additional labels to add to the Webhook Pods + podLabels: {} + + # Optional additional labels to add to the Webhook Service + serviceLabels: {} + + image: + # The container registry to pull the webhook image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager webhook + # +docs:property + repository: quay.io/jetstack/cert-manager-webhook + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the controller's ServiceAccount + # +docs:property + # annotations: {} + + # Optional additional labels to add to the webhook's ServiceAccount + # +docs:property + # labels: {} + + # Automount API credentials for a Service Account. + automountServiceAccountToken: true + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + # The port that the webhook should listen on for requests. + # In GKE private clusters, by default kubernetes apiservers are allowed to + # talk to the cluster nodes only on 443 and 10250. so configuring + # securePort: 10250, will work out of the box without needing to add firewall + # rules or requiring NET_BIND_SERVICE capabilities to bind port numbers <1000 + securePort: 10250 + + # Specifies if the webhook should be started in hostNetwork mode. + # + # Required for use in some managed kubernetes clusters (such as AWS EKS) with custom + # CNI (such as calico), because control-plane managed by AWS cannot communicate + # with pods' IP CIDR and admission webhooks are not working + # + # Since the default port for the webhook conflicts with kubelet on the host + # network, `webhook.securePort` should be changed to an available port if + # running in hostNetwork mode. + hostNetwork: false + + # Specifies how the service should be handled. Useful if you want to expose the + # webhook to outside of the cluster. In some cases, the control plane cannot + # reach internal services. + serviceType: ClusterIP + + # Specify the load balancer IP for the created service + # +docs:property + # loadBalancerIP: "10.10.10.10" + + # Overrides the mutating webhook and validating webhook so they reach the webhook + # service using the `url` field instead of a service. + url: {} + # host: + + # Enables default network policies for webhooks. + networkPolicy: + # Create network policies for the webhooks + enabled: false + + # Ingress rule for the webhook network policy, by default will allow all + # inbound traffic + # +docs:property + ingress: + - from: + - ipBlock: + cidr: 0.0.0.0/0 + + # Egress rule for the webhook network policy, by default will allow all + # outbound traffic traffic to ports 80 and 443, as well as DNS ports + # +docs:property + egress: + - ports: + - port: 80 + protocol: TCP + - port: 443 + protocol: TCP + - port: 53 + protocol: TCP + - port: 53 + protocol: UDP + # On OpenShift and OKD, the Kubernetes API server listens on + # port 6443. + - port: 6443 + protocol: TCP + to: + - ipBlock: + cidr: 0.0.0.0/0 + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false + + # +docs:section=CA Injector + + cainjector: + # Create the CA Injector deployment + enabled: true + + # Number of replicas of the cert-manager cainjector to run. + # + # The default is 1, but in production you should set this to 2 or 3 to provide high + # availability. + # + # If `replicas > 1` you should also consider setting `cainjector.podDisruptionBudget.enabled=true`. + # + # Note: cert-manager uses leader election to ensure that there can + # only be a single instance active at a time. + {{- if .Modules.Additional.CertManager.HaEnabled }} + replicaCount: 3 + {{- else }} + replicaCount: 1 + {{- end }} + + # Used to configure options for the cainjector pod. + # This allows setting options that'd usually be provided via flags. + # An APIVersion and Kind must be specified in your values.yaml file. + # Flags will override options that are set here. + # + # For example: + # apiVersion: cainjector.config.cert-manager.io/v1alpha1 + # kind: CAInjectorConfiguration + # logging: + # verbosity: 2 + # format: text + # leaderElectionConfig: + # namespace: kube-system + config: {} + + # Deployment update strategy for the cert-manager cainjector deployment. + # See https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy + # + # For example: + # strategy: + # type: RollingUpdate + # rollingUpdate: + # maxSurge: 0 + # maxUnavailable: 1 + strategy: {} + + # Pod Security Context to be set on the cainjector component Pod + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the cainjector component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + podDisruptionBudget: + # Enable or disable the PodDisruptionBudget resource + # + # This prevents downtime during voluntary disruptions such as during a Node upgrade. + # For example, the PodDisruptionBudget will block `kubectl drain` + # if it is used on the Node where the only remaining cert-manager + # Pod is currently running. + enabled: false + + # Configures the minimum available pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `maxUnavailable` is set. + # +docs:property + # minAvailable: 1 + + # Configures the maximum unavailable pods for disruptions. Can either be set to + # an integer (e.g. 1) or a percentage value (e.g. 25%). + # Cannot be used if `minAvailable` is set. + # +docs:property + # maxUnavailable: 1 + + # Optional additional annotations to add to the cainjector Deployment + # +docs:property + # deploymentAnnotations: {} + + # Optional additional annotations to add to the cainjector Pods + # +docs:property + # podAnnotations: {} + + # Additional command line flags to pass to cert-manager cainjector binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-cainjector: --help + extraArgs: [] + # Enable profiling for cainjector + # - --enable-profiling=true + + # Comma separated list of feature gates that should be enabled on the + # cainjector pod. + featureGates: "" + + # Resources to provide to the cert-manager cainjector pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # A list of Kubernetes TopologySpreadConstraints, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#topologyspreadconstraint-v1-core + # + # For example: + # topologySpreadConstraints: + # - maxSkew: 2 + # topologyKey: topology.kubernetes.io/zone + # whenUnsatisfiable: ScheduleAnyway + # labelSelector: + # matchLabels: + # app.kubernetes.io/instance: cert-manager + # app.kubernetes.io/component: controller + topologySpreadConstraints: [] + + # Optional additional labels to add to the CA Injector Pods + podLabels: {} + + image: + # The container registry to pull the cainjector image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager cainjector + # +docs:property + repository: quay.io/jetstack/cert-manager-cainjector + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the controller's ServiceAccount + # +docs:property + # annotations: {} + + # Optional additional labels to add to the cainjector's ServiceAccount + # +docs:property + # labels: {} + + # Automount API credentials for a Service Account. + automountServiceAccountToken: true + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false + + # +docs:section=ACME Solver + + acmesolver: + image: + # The container registry to pull the acmesolver image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager acmesolver + # +docs:property + repository: quay.io/jetstack/cert-manager-acmesolver + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + # +docs:section=Startup API Check + # This startupapicheck is a Helm post-install hook that waits for the webhook + # endpoints to become available. + # The check is implemented using a Kubernetes Job - if you are injecting mesh + # sidecar proxies into cert-manager pods, you probably want to ensure that they + # are not injected into this Job's pod. Otherwise the installation may time out + # due to the Job never being completed because the sidecar proxy does not exit. + # See https://github.com/cert-manager/cert-manager/pull/4414 for context. + + startupapicheck: + # Enables the startup api check + enabled: true + + # Pod Security Context to be set on the startupapicheck component Pod + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + securityContext: + runAsNonRoot: true + seccompProfile: + type: RuntimeDefault + + # Container Security Context to be set on the controller component container + # ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ + # +docs:property + containerSecurityContext: + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + + # Timeout for 'kubectl check api' command + timeout: 1m + + # Job backoffLimit + backoffLimit: 4 + + # Optional additional annotations to add to the startupapicheck Job + # +docs:property + jobAnnotations: + helm.sh/hook: post-install + helm.sh/hook-weight: "1" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + + # Optional additional annotations to add to the startupapicheck Pods + # +docs:property + # podAnnotations: {} + + # Additional command line flags to pass to startupapicheck binary. + # To see all available flags run docker run quay.io/jetstack/cert-manager-ctl: --help + # + # We enable verbose logging by default so that if startupapicheck fails, users + # can know what exactly caused the failure. Verbose logs include details of + # the webhook URL, IP address and TCP connect errors for example. + # +docs:property + extraArgs: + - -v + + # Resources to provide to the cert-manager controller pod + # + # For example: + # requests: + # cpu: 10m + # memory: 32Mi + # + # ref: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/ + resources: {} + + + # The nodeSelector on Pods tells Kubernetes to schedule Pods on the nodes with + # matching labels. + # See https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + # + # This default ensures that Pods are only scheduled to Linux nodes. + # It prevents Pods being scheduled to Windows nodes in a mixed OS cluster. + # +docs:property + nodeSelector: + kubernetes.io/os: linux + + # A Kubernetes Affinity, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#affinity-v1-core + # + # For example: + # affinity: + # nodeAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # nodeSelectorTerms: + # - matchExpressions: + # - key: foo.bar.com/role + # operator: In + # values: + # - master + affinity: {} + + # A list of Kubernetes Tolerations, if required; see https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.27/#toleration-v1-core + # + # For example: + # tolerations: + # - key: foo.bar.com/role + # operator: Equal + # value: master + # effect: NoSchedule + tolerations: [] + + # Optional additional labels to add to the startupapicheck Pods + podLabels: {} + + image: + # The container registry to pull the startupapicheck image from + # +docs:property + # registry: quay.io + + # The container image for the cert-manager startupapicheck + # +docs:property + repository: quay.io/jetstack/cert-manager-startupapicheck + + # Override the image tag to deploy by setting this variable. + # If no value is set, the chart's appVersion will be used. + # +docs:property + # tag: vX.Y.Z + + # Setting a digest will override any tag + # +docs:property + # digest: sha256:0e072dddd1f7f8fc8909a2ca6f65e76c5f0d2fcfb8be47935ae3457e8bbceb20 + + # Kubernetes imagePullPolicy on Deployment. + pullPolicy: IfNotPresent + + rbac: + # annotations for the startup API Check job RBAC and PSP resources + # +docs:property + annotations: + helm.sh/hook: post-install + helm.sh/hook-weight: "-5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + + # Automounting API credentials for a particular pod + # +docs:property + # automountServiceAccountToken: true + + serviceAccount: + # Specifies whether a service account should be created + create: true + + # The name of the service account to use. + # If not set and create is true, a name is generated using the fullname template + # +docs:property + # name: "" + + # Optional additional annotations to add to the Job's ServiceAccount + # +docs:property + annotations: + helm.sh/hook: post-install + helm.sh/hook-weight: "-5" + helm.sh/hook-delete-policy: before-hook-creation,hook-succeeded + + # Automount API credentials for a Service Account. + # +docs:property + automountServiceAccountToken: true + + # Optional additional labels to add to the startupapicheck's ServiceAccount + # +docs:property + # labels: {} + + # Additional volumes to add to the cert-manager controller pod. + volumes: [] + + # Additional volume mounts to add to the cert-manager controller container. + volumeMounts: [] + + # enableServiceLinks indicates whether information about services should be + # injected into pod's environment variables, matching the syntax of Docker + # links. + enableServiceLinks: false diff --git a/pkg/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl b/pkg/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl index e69de29..e090b9e 100644 --- a/pkg/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl +++ b/pkg/resources/templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl @@ -0,0 +1,908 @@ +- name: ingress-nginx + namespace: ingress-nginx + create_namespace: true + chart_ref: kube-forge/ingress-nginx + chart_version: 4.10.1 + {{- if and .Modules.Additional.Ingress.Enabled (eq .Modules.Additional.Ingress.Type "nginx") }} + release_state: "present" + {{- else }} + release_state: "absent" + {{- end }} + values: + commonLabels: {} + controller: + name: controller + enableAnnotationValidations: false + image: + ## Keep false as default for now! + chroot: false + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + repository: {{ .Modules.Additional.Ingress.Nginx.Controller.Image }} + tag: "{{ .Modules.Additional.Ingress.Nginx.Controller.Tag }}" + digest: sha256:5b161f051d017e55d358435f295f5e9a297e66158f136321d9b04520ec6c48a3 + digestChroot: sha256:5976b1067cfbca8a21d0ba53d71f83543a73316a61ea7f7e436d6cf84ddf9b26 + pullPolicy: IfNotPresent + # www-data -> uid 101 + runAsUser: 101 + allowPrivilegeEscalation: true + # -- Use an existing PSP instead of creating one + existingPsp: "" + # -- Configures the controller container name + containerName: controller + # -- Configures the ports that the nginx-controller listens on + containerPort: + http: 80 + https: 443 + # -- Will add custom configuration options to Nginx https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ + config: {} + # -- Annotations to be added to the controller config configuration configmap. + configAnnotations: {} + # -- Will add custom headers before sending traffic to backends according to https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/custom-headers + proxySetHeaders: {} + # -- Will add custom headers before sending response traffic to the client according to: https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#add-headers + addHeaders: {} + # -- Optionally customize the pod dnsConfig. + dnsConfig: {} + # -- Optionally customize the pod hostAliases. + hostAliases: [] + # - ip: 127.0.0.1 + # hostnames: + # - foo.local + # - bar.local + # - ip: 10.1.2.3 + # hostnames: + # - foo.remote + # - bar.remote + # -- Optionally customize the pod hostname. + hostname: {} + # -- Optionally change this to ClusterFirstWithHostNet in case you have 'hostNetwork: true'. + # By default, while using host network, name resolution uses the host's DNS. If you wish nginx-controller + # to keep resolving names inside the k8s network, use ClusterFirstWithHostNet. + dnsPolicy: ClusterFirst + # -- Bare-metal considerations via the host network https://kubernetes.github.io/ingress-nginx/deploy/baremetal/#via-the-host-network + # Ingress status was blank because there is no Service exposing the Ingress-Nginx Controller in a configuration using the host network, the default --publish-service flag used in standard cloud setups does not apply + reportNodeInternalIp: false + # -- Process Ingress objects without ingressClass annotation/ingressClassName field + # Overrides value for --watch-ingress-without-class flag of the controller binary + # Defaults to false + watchIngressWithoutClass: false + # -- Process IngressClass per name (additionally as per spec.controller). + ingressClassByName: false + # -- This configuration enables Topology Aware Routing feature, used together with service annotation service.kubernetes.io/topology-mode="auto" + # Defaults to false + enableTopologyAwareRouting: false + # -- This configuration defines if Ingress Controller should allow users to set + # their own *-snippet annotations, otherwise this is forbidden / dropped + # when users add those annotations. + # Global snippets in ConfigMap are still respected + allowSnippetAnnotations: true + # -- Required for use with CNI based kubernetes installations (such as ones set up by kubeadm), + # since CNI and hostport don't mix yet. Can be deprecated once https://github.com/kubernetes/kubernetes/issues/23920 + # is merged + hostNetwork: {{ .Modules.Additional.Ingress.HostNetwork }} + ## Use host ports 80 and 443 + ## Disabled by default + hostPort: + # -- Enable 'hostPort' or not + enabled: false + ports: + # -- 'hostPort' http port + http: 80 + # -- 'hostPort' https port + https: 443 + # NetworkPolicy for controller component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + # -- Election ID to use for status update, by default it uses the controller name combined with a suffix of 'leader' + electionID: "" + ## This section refers to the creation of the IngressClass resource + ## IngressClass resources are supported since k8s >= 1.18 and required since k8s >= 1.19 + ingressClassResource: + # -- Name of the ingressClass + name: nginx + # -- Is this ingressClass enabled or not + enabled: true + # -- Is this the default ingressClass for the cluster + default: false + # -- Controller-value of the controller that is processing this ingressClass + controllerValue: "k8s.io/ingress-nginx" + # -- Parameters is a link to a custom resource containing additional + # configuration for the controller. This is optional if the controller + # does not require extra parameters. + parameters: {} + # -- For backwards compatibility with ingress.class annotation, use ingressClass. + # Algorithm is as follows, first ingressClassName is considered, if not present, controller looks for ingress.class annotation + ingressClass: {{ .Modules.Additional.Ingress.IngressClassName }} + # -- Labels to add to the pod container metadata + podLabels: {} + + # -- Security Context policies for controller pods + podSecurityContext: {} + # -- See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for notes on enabling and using sysctls + sysctls: {} + # sysctls: + # "net.core.somaxconn": "8192" + + # -- Allows customization of the source of the IP address or FQDN to report + # in the ingress status field. By default, it reads the information provided + # by the service. If disable, the status field reports the IP address of the + # node or nodes where an ingress controller pod is running. + publishService: + # -- Enable 'publishService' or not + enabled: true + # -- Allows overriding of the publish service to bind to + # Must be / + pathOverride: "" + # Limit the scope of the controller to a specific namespace + scope: + # -- Enable 'scope' or not + enabled: false + # -- Namespace to limit the controller to; defaults to $(POD_NAMESPACE) + namespace: "" + # -- When scope.enabled == false, instead of watching all namespaces, we watching namespaces whose labels + # only match with namespaceSelector. Format like foo=bar. Defaults to empty, means watching all namespaces. + namespaceSelector: "" + # -- Allows customization of the configmap / nginx-configmap namespace; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + tcp: + # -- Allows customization of the tcp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the tcp config configmap + annotations: {} + udp: + # -- Allows customization of the udp-services-configmap; defaults to $(POD_NAMESPACE) + configMapNamespace: "" + # -- Annotations to be added to the udp config configmap + annotations: {} + # -- Maxmind license key to download GeoLite2 Databases. + ## https://blog.maxmind.com/2019/12/18/significant-changes-to-accessing-and-using-geolite2-databases + maxmindLicenseKey: "" + # -- Additional command line arguments to pass to Ingress-Nginx Controller + # E.g. to specify the default SSL certificate you can use + extraArgs: {} + ## extraArgs: + ## default-ssl-certificate: "/" + + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + + # -- Use a `DaemonSet` or `Deployment` + kind: DaemonSet + # -- Annotations to be added to the controller Deployment or DaemonSet + ## + annotations: {} + # keel.sh/pollSchedule: "@every 60m" + + # -- Labels to be added to the controller Deployment or DaemonSet and other resources that do not have option to specify labels + ## + labels: {} + # keel.sh/policy: patch + # keel.sh/trigger: poll + + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + # -- Affinity and anti-affinity rules for server scheduling to nodes + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity + ## + affinity: {} + # # An example of preferred pod anti-affinity, weight is in the range 1-100 + # podAntiAffinity: + # preferredDuringSchedulingIgnoredDuringExecution: + # - weight: 100 + # podAffinityTerm: + # labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: kubernetes.io/hostname + + # # An example of required pod anti-affinity + # podAntiAffinity: + # requiredDuringSchedulingIgnoredDuringExecution: + # - labelSelector: + # matchExpressions: + # - key: app.kubernetes.io/name + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/instance + # operator: In + # values: + # - ingress-nginx + # - key: app.kubernetes.io/component + # operator: In + # values: + # - controller + # topologyKey: "kubernetes.io/hostname" + + # -- Topology spread constraints rely on node labels to identify the topology domain(s) that each Node is in. + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/ + ## + topologySpreadConstraints: [] + + # -- `terminationGracePeriodSeconds` to avoid killing pods before we are ready + ## wait up to five minutes for the drain of connections + ## + terminationGracePeriodSeconds: 300 + # -- Node labels for controller pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: + kubernetes.io/os: linux + ## Liveness and readiness probe values + ## Ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes + ## + ## startupProbe: + ## httpGet: + ## # should match container.healthCheckPath + ## path: "/healthz" + ## port: 10254 + ## scheme: HTTP + ## initialDelaySeconds: 5 + ## periodSeconds: 5 + ## timeoutSeconds: 2 + ## successThreshold: 1 + ## failureThreshold: 5 + livenessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 5 + readinessProbe: + httpGet: + # should match container.healthCheckPath + path: "/healthz" + port: 10254 + scheme: HTTP + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 1 + successThreshold: 1 + failureThreshold: 3 + # -- Path of the health check endpoint. All requests received on the port defined by + # the healthz-port parameter are forwarded internally to this path. + healthCheckPath: "/healthz" + # -- Address to bind the health check endpoint. + # It is better to set this option to the internal node address + # if the Ingress-Nginx Controller is running in the `hostNetwork: true` mode. + healthCheckHost: "" + # -- Annotations to be added to controller pods + ## + podAnnotations: {} + replicaCount: 1 + # -- Minimum available pods set in PodDisruptionBudget. + # Define either 'minAvailable' or 'maxUnavailable', never both. + minAvailable: 1 + # -- Maximum unavalaile pods set in PodDisruptionBudget. If set, 'minAvailable' is ignored. + # maxUnavailable: 1 + + ## Define requests resources to avoid probe issues due to CPU utilization in busy nodes + ## ref: https://github.com/kubernetes/ingress-nginx/issues/4735#issuecomment-551204903 + ## Ideally, there should be no limits. + ## https://engineering.indeedblog.com/blog/2019/12/cpu-throttling-regression-fix/ + resources: + ## limits: + ## cpu: 100m + ## memory: 90Mi + requests: + cpu: 100m + memory: 90Mi + # Mutually exclusive with keda autoscaling + autoscaling: + enabled: false + annotations: {} + minReplicas: 1 + maxReplicas: 11 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + autoscalingTemplate: [] + # Custom or additional autoscaling metrics + # ref: https://kubernetes.io/docs/tasks/run-application/horizontal-pod-autoscale/#support-for-custom-metrics + # - type: Pods + # pods: + # metric: + # name: nginx_ingress_controller_nginx_process_requests_total + # target: + # type: AverageValue + # averageValue: 10000m + + # Mutually exclusive with hpa autoscaling + keda: + apiVersion: "keda.sh/v1alpha1" + ## apiVersion changes with keda 1.x vs 2.x + ## 2.x = keda.sh/v1alpha1 + ## 1.x = keda.k8s.io/v1alpha1 + enabled: false + minReplicas: 1 + maxReplicas: 11 + pollingInterval: 30 + cooldownPeriod: 300 + # fallback: + # failureThreshold: 3 + # replicas: 11 + restoreToOriginalReplicaCount: false + scaledObject: + annotations: {} + # Custom annotations for ScaledObject resource + # annotations: + # key: value + triggers: [] + # - type: prometheus + # metadata: + # serverAddress: http://:9090 + # metricName: http_requests_total + # threshold: '100' + # query: sum(rate(http_requests_total{deployment="my-deployment"}[2m])) + + behavior: {} + # scaleDown: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 1 + # periodSeconds: 180 + # scaleUp: + # stabilizationWindowSeconds: 300 + # policies: + # - type: Pods + # value: 2 + # periodSeconds: 60 + # -- Enable mimalloc as a drop-in replacement for malloc. + ## ref: https://github.com/microsoft/mimalloc + ## + enableMimalloc: true + ## Override NGINX template + customTemplate: + configMapName: "" + configMapKey: "" + service: + enabled: true + # -- If enabled is adding an appProtocol option for Kubernetes service. An appProtocol field replacing annotations that were + # using for setting a backend protocol. Here is an example for AWS: service.beta.kubernetes.io/aws-load-balancer-backend-protocol: http + # It allows choosing the protocol for each backend specified in the Kubernetes service. + # See the following GitHub issue for more details about the purpose: https://github.com/kubernetes/kubernetes/issues/40244 + # Will be ignored for Kubernetes versions older than 1.20 + ## + appProtocol: true + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. + annotations: {} + labels: {} + # clusterIP: "" + + # -- List of IP addresses at which the controller services are available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # -- Used by cloud providers to connect the resulting `LoadBalancer` to a pre-existing static IP according to https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer + loadBalancerIP: "" + loadBalancerSourceRanges: [] + # -- Used by cloud providers to select a load balancer implementation other than the cloud provider default. https://kubernetes.io/docs/concepts/services-networking/service/#load-balancer-class + loadBalancerClass: "" + enableHttp: true + enableHttps: true + ## Set external traffic policy to: "Local" to preserve source IP on providers supporting it. + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" + + ## Must be either "None" or "ClientIP" if set. Kubernetes will default to "None". + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#virtual-ips-and-service-proxies + # sessionAffinity: "" + + ## Specifies the health check node port (numeric port number) for the service. If healthCheckNodePort isn’t specified, + ## the service controller allocates a port from your cluster’s NodePort range. + ## Ref: https://kubernetes.io/docs/tasks/access-application-cluster/create-external-load-balancer/#preserving-the-client-source-ip + # healthCheckNodePort: 0 + + # -- Represents the dual-stack-ness requested or required by this Service. Possible values are + # SingleStack, PreferDualStack or RequireDualStack. + # The ipFamilies and clusterIPs fields depend on the value of this field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilyPolicy: "SingleStack" + # -- List of IP families (e.g. IPv4, IPv6) assigned to the service. This field is usually assigned automatically + # based on cluster configuration and the ipFamilyPolicy field. + ## Ref: https://kubernetes.io/docs/concepts/services-networking/dual-stack/ + ipFamilies: + - IPv4 + ports: + http: 80 + https: 443 + targetPorts: + http: http + https: https + type: "" + # type: NodePort + # nodePorts: + # http: 32080 + # https: 32443 + # tcp: + # 8080: 32808 + nodePorts: + http: "" + https: "" + tcp: {} + udp: {} + external: + enabled: true + internal: + # -- Enables an additional internal load balancer (besides the external one). + enabled: false + # -- Annotations are mandatory for the load balancer to come up. Varies with the cloud service. Values passed through helm tpl engine. + annotations: {} + # -- Used by cloud providers to connect the resulting internal LoadBalancer to a pre-existing static IP. Make sure to add to the service the needed annotation to specify the subnet which the static IP belongs to. For instance, `networking.gke.io/internal-load-balancer-subnet` for GCP and `service.beta.kubernetes.io/aws-load-balancer-subnets` for AWS. + loadBalancerIP: "" + # -- Restrict access For LoadBalancer service. Defaults to 0.0.0.0/0. + loadBalancerSourceRanges: [] + ## Set external traffic policy to: "Local" to preserve source IP on + ## providers supporting it + ## Ref: https://kubernetes.io/docs/tutorials/services/source-ip/#source-ip-for-services-with-typeloadbalancer + # externalTrafficPolicy: "" + + # -- Custom port mapping for internal service + ports: {} + # http: 80 + # https: 443 + + # -- Custom target port mapping for internal service + targetPorts: {} + # http: http + # https: https + # shareProcessNamespace enables process namespace sharing within the pod. + # This can be used for example to signal log rotation using `kill -USR1` from a sidecar. + shareProcessNamespace: false + # -- Additional containers to be added to the controller pod. + # See https://github.com/lemonldap-ng-controller/lemonldap-ng-controller as example. + extraContainers: [] + # - name: my-sidecar + # image: nginx:latest + # - name: lemonldap-ng-controller + # image: lemonldapng/lemonldap-ng-controller:0.2.0 + # args: + # - /lemonldap-ng-controller + # - --alsologtostderr + # - --configmap=$(POD_NAMESPACE)/lemonldap-ng-configuration + # env: + # - name: POD_NAME + # valueFrom: + # fieldRef: + # fieldPath: metadata.name + # - name: POD_NAMESPACE + # valueFrom: + # fieldRef: + # fieldPath: metadata.namespace + # volumeMounts: + # - name: copy-portal-skins + # mountPath: /srv/var/lib/lemonldap-ng/portal/skins + + # -- Additional volumeMounts to the controller main container. + extraVolumeMounts: [] + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + # -- Additional volumes to the controller pod. + extraVolumes: [] + # - name: copy-portal-skins + # emptyDir: {} + + # -- Containers, which are run before the app containers are started. + extraInitContainers: [] + # - name: init-myservice + # image: busybox + # command: ['sh', '-c', 'until nslookup myservice; do echo waiting for myservice; sleep 2; done;'] + + # -- Modules, which are mounted into the core nginx image. See values.yaml for a sample to add opentelemetry module + extraModules: [] + # - name: mytestmodule + # image: registry.k8s.io/ingress-nginx/mytestmodule + # containerSecurityContext: + # allowPrivilegeEscalation: false + # + # The image must contain a `/usr/local/bin/init_module.sh` executable, which + # will be executed as initContainers, to move its config files within the + # mounted volume. + + opentelemetry: + enabled: false + image: registry.k8s.io/ingress-nginx/opentelemetry:v20230721-3e2062ee5@sha256:13bee3f5223883d3ca62fee7309ad02d22ec00ff0d7033e3e9aca7a9f60fd472 + containerSecurityContext: + allowPrivilegeEscalation: false + resources: {} + admissionWebhooks: + annotations: {} + # ignore-check.kube-linter.io/no-read-only-rootfs: "This deployment needs write access to root filesystem". + + ## Additional annotations to the admission webhooks. + ## These annotations will be added to the ValidatingWebhookConfiguration and + ## the Jobs Spec of the admission webhooks. + enabled: {{ .Modules.Additional.Ingress.EnableAdmissionWebhooks }} + # -- Additional environment variables to set + extraEnvs: [] + # extraEnvs: + # - name: FOO + # valueFrom: + # secretKeyRef: + # key: FOO + # name: secret-resource + # -- Admission Webhook failure policy to use + failurePolicy: Fail + # timeoutSeconds: 10 + port: 8443 + certificate: "/usr/local/certificates/cert" + key: "/usr/local/certificates/key" + namespaceSelector: {} + objectSelector: {} + # -- Labels to be added to admission webhooks + labels: {} + # -- Use an existing PSP instead of creating one + existingPsp: "" + service: + annotations: {} + # clusterIP: "" + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 443 + type: ClusterIP + createSecretJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + patchWebhookJob: + securityContext: + allowPrivilegeEscalation: false + resources: {} + patch: + enabled: true + image: + registry: registry.k8s.io + image: ingress-nginx/kube-webhook-certgen + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + ## repository: + tag: v20231011-8b53cabe0 + digest: sha256:a7943503b45d552785aa3b5e457f169a5661fb94d82b8a3373bcd9ebaf9aac80 + pullPolicy: IfNotPresent + # -- Provide a priority class name to the webhook patching job + ## + priorityClassName: "" + podAnnotations: {} + nodeSelector: + kubernetes.io/os: linux + tolerations: [] + # -- Labels to be added to patch job resources + labels: {} + securityContext: + runAsNonRoot: true + runAsUser: 2000 + fsGroup: 2000 + # Use certmanager to generate webhook certs + certManager: + enabled: false + # self-signed root certificate + rootCert: + # default to be 5y + duration: "" + admissionCert: + # default to be 1y + duration: "" + # issuerRef: + # name: "issuer" + # kind: "ClusterIssuer" + metrics: + port: 10254 + portName: metrics + # if this port is changed, change healthz-port: in extraArgs: accordingly + enabled: false + service: + annotations: {} + # prometheus.io/scrape: "true" + # prometheus.io/port: "10254" + # -- Labels to be added to the metrics service resource + labels: {} + # clusterIP: "" + + # -- List of IP addresses at which the stats-exporter service is available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 10254 + type: ClusterIP + # externalTrafficPolicy: "" + # nodePort: "" + serviceMonitor: + enabled: false + additionalLabels: {} + ## The label to use to retrieve the job name from. + ## jobLabel: "app.kubernetes.io/name" + namespace: "" + namespaceSelector: {} + ## Default: scrape .Release.Namespace or namespaceOverride only + ## To scrape all, use the following: + ## namespaceSelector: + ## any: true + scrapeInterval: 30s + # honorLabels: true + targetLabels: [] + relabelings: [] + metricRelabelings: [] + prometheusRule: + enabled: false + additionalLabels: {} + # namespace: "" + rules: [] + # # These are just examples rules, please adapt them to your needs + # - alert: NGINXConfigFailed + # expr: count(nginx_ingress_controller_config_last_reload_successful == 0) > 0 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: bad ingress config - nginx config test failed + # summary: uninstall the latest ingress changes to allow config reloads to resume + # - alert: NGINXCertificateExpiry + # expr: (avg(nginx_ingress_controller_ssl_expire_time_seconds) by (host) - time()) < 604800 + # for: 1s + # labels: + # severity: critical + # annotations: + # description: ssl certificate(s) will expire in less then a week + # summary: renew expiring certificates to avoid downtime + # - alert: NGINXTooMany500s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"5.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 5XXs + # summary: More than 5% of all requests returned 5XX, this requires your attention + # - alert: NGINXTooMany400s + # expr: 100 * ( sum( nginx_ingress_controller_requests{status=~"4.+"} ) / sum(nginx_ingress_controller_requests) ) > 5 + # for: 1m + # labels: + # severity: warning + # annotations: + # description: Too many 4XXs + # summary: More than 5% of all requests returned 4XX, this requires your attention + # -- Improve connection draining when ingress controller pod is deleted using a lifecycle hook: + # With this new hook, we increased the default terminationGracePeriodSeconds from 30 seconds + # to 300, allowing the draining of connections up to five minutes. + # If the active connections end before that, the pod will terminate gracefully at that time. + # To effectively take advantage of this feature, the Configmap feature + # worker-shutdown-timeout new value is 240s instead of 10s. + ## + lifecycle: + preStop: + exec: + command: + - /wait-shutdown + priorityClassName: "" + # -- Rollback limit + ## + revisionHistoryLimit: 10 + ## Default 404 backend + ## + defaultBackend: + ## + enabled: false + name: defaultbackend + image: + ## for backwards compatibility consider setting the full image url via the repository value below + ## use *either* current default registry/image or repository format or installing chart by providing the values.yaml will fail + repository: {{ .Modules.Additional.Ingress.Nginx.DefaultBackend.Image }} + tag: "{{ .Modules.Additional.Ingress.Nginx.DefaultBackend.Tag }}" + pullPolicy: IfNotPresent + # nobody user -> uid 65534 + runAsUser: 65534 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + # -- Use an existing PSP instead of creating one + existingPsp: "" + extraArgs: {} + serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Additional environment variables to set for defaultBackend pods + extraEnvs: [] + port: 8080 + ## Readiness and liveness probes for default backend + ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/ + ## + livenessProbe: + failureThreshold: 3 + initialDelaySeconds: 30 + periodSeconds: 10 + successThreshold: 1 + timeoutSeconds: 5 + readinessProbe: + failureThreshold: 6 + initialDelaySeconds: 0 + periodSeconds: 5 + successThreshold: 1 + timeoutSeconds: 5 + # -- The update strategy to apply to the Deployment or DaemonSet + ## + updateStrategy: {} + # rollingUpdate: + # maxUnavailable: 1 + # type: RollingUpdate + + # -- `minReadySeconds` to avoid killing pods before we are ready + ## + minReadySeconds: 0 + # -- Node tolerations for server scheduling to nodes with taints + ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/ + ## + tolerations: [] + # - key: "key" + # operator: "Equal|Exists" + # value: "value" + # effect: "NoSchedule|PreferNoSchedule|NoExecute(1.6 only)" + + affinity: {} + # -- Security Context policies for controller pods + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + podSecurityContext: {} + # -- Security Context policies for controller main container. + # See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for + # notes on enabling and using sysctls + ## + containerSecurityContext: {} + # -- Labels to add to the pod container metadata + podLabels: {} + # -- Node labels for default backend pod assignment + ## Ref: https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/ + ## + nodeSelector: + kubernetes.io/os: linux + # -- Annotations to be added to default backend pods + ## + podAnnotations: {} + replicaCount: 1 + minAvailable: 1 + resources: {} + # limits: + # cpu: 10m + # memory: 20Mi + # requests: + # cpu: 10m + # memory: 20Mi + + extraVolumeMounts: [] + ## Additional volumeMounts to the default backend container. + # - name: copy-portal-skins + # mountPath: /var/lib/lemonldap-ng/portal/skins + + extraVolumes: [] + ## Additional volumes to the default backend pod. + # - name: copy-portal-skins + # emptyDir: {} + + autoscaling: + annotations: {} + enabled: false + minReplicas: 1 + maxReplicas: 2 + targetCPUUtilizationPercentage: 50 + targetMemoryUtilizationPercentage: 50 + # NetworkPolicy for default backend component. + networkPolicy: + # -- Enable 'networkPolicy' or not + enabled: false + service: + annotations: {} + # clusterIP: "" + + # -- List of IP addresses at which the default backend service is available + ## Ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips + ## + externalIPs: [] + # loadBalancerIP: "" + loadBalancerSourceRanges: [] + servicePort: 80 + type: ClusterIP + priorityClassName: "" + # -- Labels to be added to the default backend resources + labels: {} + ## Enable RBAC as per https://github.com/kubernetes/ingress-nginx/blob/main/docs/deploy/rbac.md and https://github.com/kubernetes/ingress-nginx/issues/266 + rbac: + create: true + scope: false + ## If true, create & use Pod Security Policy resources + ## https://kubernetes.io/docs/concepts/policy/pod-security-policy/ + podSecurityPolicy: + enabled: false + serviceAccount: + create: true + name: "" + automountServiceAccountToken: true + # -- Annotations for the controller service account + annotations: {} + # -- Optional array of imagePullSecrets containing private registry credentials + ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/ + imagePullSecrets: [] + # - name: secretName + + # -- TCP service key-value pairs + ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md + ## + tcp: {} + # 8080: "default/example-tcp-svc:9000" + + # -- UDP service key-value pairs + ## Ref: https://github.com/kubernetes/ingress-nginx/blob/main/docs/user-guide/exposing-tcp-udp-services.md + ## + udp: {} + # 53: "kube-system/kube-dns:53" + + # -- Prefix for TCP and UDP ports names in ingress controller service + ## Some cloud providers, like Yandex Cloud may have a requirements for a port name regex to support cloud load balancer integration + portNamePrefix: "" + # -- (string) A base64-encoded Diffie-Hellman parameter. + # This can be generated with: `openssl dhparam 4096 2> /dev/null | base64` + ## Ref: https://github.com/kubernetes/ingress-nginx/tree/main/docs/examples/customization/ssl-dh-param + dhParam: "" diff --git a/pkg/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl b/pkg/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl index 1f06ce1..9d42bc7 100644 --- a/pkg/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl +++ b/pkg/resources/templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl @@ -1,9 +1,13 @@ -{{- if .Modules.Additional.Storage.Longhorn.Enabled }} - name: longhorn namespace: longhorn-system create_namespace: true chart_ref: kube-forge/longhorn chart_version: 1.6.1 + {{- if .Modules.Additional.Storage.Longhorn.Enabled }} + release_state: "present" + {{- else }} + release_state: "absent" + {{- end }} values: global: cattle: @@ -484,4 +488,3 @@ # -- Setting that allows Longhorn to generate code coverage profiles. enableGoCoverDir: false -{{- end }} diff --git a/pkg/resources/templates/helm-apps/releases/observability/observability.yml.tmpl b/pkg/resources/templates/helm-apps/releases/observability/observability.yml.tmpl index f98cdb2..94a709b 100644 --- a/pkg/resources/templates/helm-apps/releases/observability/observability.yml.tmpl +++ b/pkg/resources/templates/helm-apps/releases/observability/observability.yml.tmpl @@ -33,6 +33,74 @@ scrapeInterval: {{ .Modules.Observability.Monitoring.Prometheus.ScrapeInterval }} retention: {{ .Modules.Observability.Monitoring.Prometheus.Persistence.Retention }} # serviceNodePort: 30008 + additionalConfigs: | + - job_name: "kubelet" + scheme: https + metrics_path: /metrics/cadvisor + tls_config: + insecure_skip_verify: true + authorization: + credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token + kubernetes_sd_configs: + - role: node + relabel_configs: + - action: labelmap + regex: __meta_kubernetes_node_label_(.+) + + - job_name: "kubernetes-apiservers" + kubernetes_sd_configs: + - role: endpoints + scheme: https + tls_config: + ca_file: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt + authorization: + credentials_file: /var/run/secrets/kubernetes.io/serviceaccount/token + relabel_configs: + - source_labels: + [ + __meta_kubernetes_namespace, + __meta_kubernetes_service_name, + __meta_kubernetes_endpoint_port_name, + ] + action: keep + regex: default;kubernetes;https + + - job_name: "coredns" + kubernetes_sd_configs: + - role: endpoints + scheme: http + relabel_configs: + - source_labels: + [ + __meta_kubernetes_namespace, + __meta_kubernetes_service_name, + __meta_kubernetes_endpoint_port_name, + ] + action: keep + regex: kube-system;.*dns.*;metrics + + - job_name: 'ingress-endpoints' + metrics_path: /probe + params: + module: [https_ok] + kubernetes_sd_configs: + - role: ingress + relabel_configs: + - source_labels: [__address__] + target_label: __param_target + - source_labels: [__param_target] + target_label: instance + - source_labels: + [ + __meta_kubernetes_ingress_scheme, + __address__, + __meta_kubernetes_ingress_path, + ] + regex: (.+);(.+);(.+) + replacement: https://${2}${3} + target_label: __param_target + - target_label: __address__ + replacement: observability-blackbox-exporter:9115 alertManager: enabled: {{ .Modules.Observability.Monitoring.AlertManager.Enabled }} @@ -46,13 +114,18 @@ # serviceNodePort: 30009 configPath: /etc/alertmanager - + {{- if .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates }} + additionalMessageTemplates: + {{- .Modules.Observability.Monitoring.AlertManager.AdditionalMessageTemplates | toYaml | nindent 8 }} + {{- end }} + {{- if .Modules.Observability.Monitoring.AlertManager.Route }} route: {{- .Modules.Observability.Monitoring.AlertManager.Route | toYaml | nindent 8 }} - + {{- end }} + {{- if .Modules.Observability.Monitoring.AlertManager.Receivers }} receivers: {{- .Modules.Observability.Monitoring.AlertManager.Receivers | toYaml | nindent 8 }} - + {{- end }} blackboxExporter: enabled: {{ .Modules.Observability.Monitoring.Blackbox.Enabled }} diff --git a/pkg/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl b/pkg/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl index 9026b7f..6c952af 100644 --- a/pkg/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl +++ b/pkg/resources/templates/kubespray/inventory/group_vars/all.yml.tmpl @@ -134,3 +134,8 @@ unsafe_show_logs: false ## If enabled it will allow kubespray to attempt setup even if the distribution is not supported. For unsupported distributions this can lead to unexpected failures in some cases. allow_unsupported_distribution_setup: false + +## Containerd settings +# containerd_metadata_root_dir: /app/lib/containerd +# The state directory for containerd +# containerd_state_dir: /app/run/containerd diff --git a/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl b/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl index 400248b..51c51f3 100644 --- a/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl +++ b/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/addons.yml.tmpl @@ -83,9 +83,8 @@ rbd_provisioner_enabled: false # rbd_provisioner_reclaim_policy: Delete # Nginx ingress controller deployment -{{- if eq .Modules.Additional.Ingress.Type "nginx" }} -ingress_nginx_enabled: {{ .Modules.Additional.Ingress.Install }} -ingress_nginx_host_network: {{ .Modules.Additional.Ingress.HostNetwork }} +ingress_nginx_enabled: false +ingress_nginx_host_network: false ingress_publish_status_address: "" # ingress_nginx_nodeselector: # kubernetes.io/os: "linux" @@ -99,8 +98,8 @@ ingress_publish_status_address: "" # value: "" # effect: "NoSchedule" # ingress_nginx_namespace: "ingress-nginx" -ingress_nginx_insecure_port: {{ .Modules.Additional.Ingress.InsecurePort }} -ingress_nginx_secure_port: {{ .Modules.Additional.Ingress.SecurePort }} +ingress_nginx_insecure_port: 80 +ingress_nginx_secure_port: 443 # ingress_nginx_configmap: # map-hash-bucket-size: "128" # ssl-protocols: "TLSv1.2 TLSv1.3" @@ -111,8 +110,7 @@ ingress_nginx_secure_port: {{ .Modules.Additional.Ingress.SecurePort }} # ingress_nginx_extra_args: # - --default-ssl-certificate=default/foo-tls # ingress_nginx_termination_grace_period_seconds: 300 -ingress_nginx_class: {{ .Modules.Additional.Ingress.IngressClassName }} -{{- end }} +ingress_nginx_class: "nginx" # ALB ingress controller deployment ingress_alb_enabled: false @@ -123,7 +121,7 @@ ingress_alb_enabled: false # alb_ingress_aws_debug: "false" # Cert manager deployment -cert_manager_enabled: {{ .Modules.Additional.CertManager.Install }} +cert_manager_enabled: false # cert_manager_namespace: "cert-manager" # cert_manager_tolerations: # - key: node-role.kubernetes.io/master @@ -152,9 +150,8 @@ cert_manager_enabled: {{ .Modules.Additional.CertManager.Install }} # cert_manager_dns_policy: "ClusterFirst" cert_manager_dns_config: nameservers: - {{- range .Modules.Additional.CertManager.DnsServers }} - - "{{ . }}" - {{- end }} + - "8.8.8.8" + - "8.8.4.4" # MetalLB deployment {{- if and (eq .Modules.Additional.LoadBalancer.Type "metallb") .Modules.Additional.LoadBalancer.Install }} diff --git a/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl b/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl index fea46b2..e2e765d 100644 --- a/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl +++ b/pkg/resources/templates/kubespray/inventory/group_vars/k8s_cluster/k8s-cluster.yml.tmpl @@ -247,7 +247,7 @@ kubernetes_audit: false default_kubelet_config_dir: {{ `"{{ kube_config_dir }}/dynamic_kubelet_dir"` }} # pod security policy (RBAC must be enabled either by having 'RBAC' in authorization_modes or kubeadm enabled) -podsecuritypolicy_enabled: {{ .Orchestrator.PodSecurotyPolicyEnabled }} +podsecuritypolicy_enabled: {{ .Orchestrator.PodSecurityPolicyEnabled }} # Custom PodSecurityPolicySpec for restricted policy # podsecuritypolicy_restricted_spec: {} diff --git a/pkg/templates/templates.go b/pkg/templates/templates.go index 8965c84..c32977e 100644 --- a/pkg/templates/templates.go +++ b/pkg/templates/templates.go @@ -20,6 +20,8 @@ var K8S_TEMPLATES = [...][2]string{ var HELM_APPS_TEMPLATES = [...]string{ "templates/helm-apps/releases/additional-modules/longhorn.yml.tmpl", + "templates/helm-apps/releases/additional-modules/cert-manager.yml.tmpl", + "templates/helm-apps/releases/additional-modules/ingress-nginx.yml.tmpl", "templates/helm-apps/releases/additional-modules/secrets-store-csi-driver.yml.tmpl", "templates/helm-apps/releases/observability/fluent-operator.yml.tmpl", "templates/helm-apps/releases/observability/opentelemetry-operator.yml.tmpl",